CVE-2026-85680

Summary

The flaw allows unauthenticated attackers to inject JavaScript into the page title, potentially leading to cross-site scripting (XSS) attacks.

Exploitability

Exploitation is relatively easy as it requires an attacker to register an account and craft a malicious profile name. Precondition is the target must be using a version of the Ultimate Member plugin before 2.13.1.

Blast radius

If exploited, the attack could impact any visitor, including administrators, who view the profile of the attacker's account, potentially leading to data theft or further exploitation.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Ultimate Member 2.13.1 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.