[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJY3SC6czmWm6HgVL6ItAC-7pb9VQQz6Nn8XKQJ61DhI":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":37},"CVE-2026-8489","ultimate-member-authenticated-subscriber-stored-cross-site-scripting-via-non-html-custom-textarea-profile-field","Ultimate Member \u003C= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field","The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'about_me' parameter in all versions up to, and including, 2.11.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","ultimate-member",null,"\u003C=2.11.4","2.12.0","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-02 15:57:05","2026-07-03 04:30:16",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F229a4e61-571c-44c6-9972-4dfc743afffe?source=api-prod",1,[22,23,24,25,26,27,28,29],"changelog.txt","includes\u002Fadmin\u002Fclass-site-health.php","includes\u002Fadmin\u002Fcore\u002Fclass-admin-settings.php","includes\u002Fclass-config.php","includes\u002Fclass-init.php","includes\u002Fcore\u002Fclass-builtin.php","includes\u002Fcore\u002Fclass-fields.php","includes\u002Fcore\u002Fclass-form.php","researched",false,3,"This research plan outlines the steps to verify the Stored Cross-Site Scripting (XSS) vulnerability in Ultimate Member (CVE-2026-8489).\n\n### 1. Vulnerability Summary\nThe **Ultimate Member** plugin is vulnerable to Stored XSS via the `about_me` (meta key `description`) parameter in user profile updates. While the plugin distinguishes between HTML-enabled and non-HTML textarea fields, it fails to sufficiently sanitize input or escape output for the \"About Me\" field when configured as a standard textarea. This allows an authenticated user (Subscriber+) to inject malicious scripts into their profile, which execute when viewed by other users, including administrators.\n\n### 2. Attack Vector Analysis\n*   **Vulnerable Parameter:** `about_me` (often mapped to the `description` usermeta key).\n*   **Endpoint:** The User Profile update page (e.g., `\u002Fuser\u002F[username]\u002F?um_action=edit`).\n*   **Authentication:** Required (Subscriber-level or higher).\n*   **Vulnerable Action:** Profile submission via `POST`.\n*   **Preconditions:** The \"About Me\" field must be present in the Profile Form (default behavior).\n\n### 3. Code Flow\n1.  **Input:** A user submits the profile update form. The `POST` request contains the `description` (or `about_me`) field.\n2.  **Processing:** The submission is handled by `um\\core\\Form` (likely via `form_init` or an AJAX handler).\n3.  **Sanitization:** The plugin identifies the field type as `textarea`. In versions \u003C= 2.11.4, if the field configuration has \"Allow HTML\" set to \"No\" (the default for `about_me`), the sanitization process fails to prevent script tags or uses an insufficient filter that can be bypassed.\n4.  **Storage:** The unsanitized\u002Fpoorly sanitized value is stored in the `wp_usermeta` table under the `description` key using `update_user_meta()`.\n5.  **Output (Sink):** When a user views the profile, UM retrieves the meta value. In `includes\u002Fcore\u002Fclass-fields.php` or relevant template files (e.g., `profile.php`), the value is echoed to the page without proper `esc_html()` or `wp_kses()` escaping, leading to script execution.\n\n### 4. Nonce Acquisition Strategy\nUltimate Member enqueues a global JavaScript object containing nonces.\n1.  **Identify Shortcode:** The profile is typically rendered via the `[ultimatemember_profile]` shortcode.\n2.  **Page Creation:**\n    `wp post create --post_type=page --post_title=\"Profile\" --post_status=publish --post_content='[ultimatemember_profile]'`\n3.  **Extraction:** Navigate to the profile page as the logged-in Subscriber and use `browser_eval`:\n    *   **Variable Name:** `um_scripts`\n    *   **Nonce Key:** `nonce` (The generic UM nonce).\n    *   **Form Nonce:** UM also embeds a hidden input field `_wpnonce` inside the profile `\u003Cform>`.\n\n### 5. Exploitation Strategy\n1.  **Login:** Authenticate as a Subscriber user.\n2.  **Navigate:** Visit the \"Edit Profile\" page (URL: `\u002Fuser\u002F[user_login]\u002F?um_action=edit`).\n3.  **Capture Form Data:** Extract the `form_id` (usually a numeric ID like `123`) and the `_wpnonce` from the form.\n4.  **Send Exploit Request:**\n    *   **Tool:** `http_request`\n    *   **Method:** `POST`\n    *   **URL:** `http:\u002F\u002F[target]\u002Fuser\u002F[user_login]\u002F?um_action=edit`\n    *   **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n    *   **Body Parameters:**\n        *   `form_id`: [Extracted ID]\n        *   `um_nonce_[form_id]`: [Extracted Nonce] (UM often uses `um_nonce_[id]` as the field name)\n        *   `description`: `\u003Cscript>alert(document.domain)\u003C\u002Fscript>`\n        *   `_um_profile_row_main`: `description`\n        *   `mode`: `profile`\n5.  **Trigger:** As an Administrator, navigate to the Subscriber's public profile page: `http:\u002F\u002F[target]\u002Fuser\u002F[user_login]\u002F`.\n\n### 6. Test Data Setup\n1.  **Plugin Installation:** Install and activate `ultimate-member` version 2.11.4.\n2.  **User Creation:**\n    `wp user create attacker attacker@example.com --role=subscriber --user_pass=password`\n3.  **Form Verification:** Ensure a Profile Form exists. UM usually creates one on installation (ID 2).\n    `wp post list --post_type=um_form`\n4.  **Profile Page:** Ensure the \"User\" page is set up with the `[ultimatemember_profile]` shortcode.\n\n### 7. Expected Results\n*   The `POST` request should return a `302 Redirect` back to the profile page.\n*   The `wp_usermeta` for the attacker user will contain the literal `\u003Cscript>` tag.\n*   When visiting the profile page, an alert box showing the domain will appear in the browser, confirming the script executed.\n\n### 8. Verification Steps\n1.  **Check Database:**\n    `wp user meta get attacker description`\n    *Expected output:* `\u003Cscript>alert(document.domain)\u003C\u002Fscript>`\n2.  **Check Source Code:** Use `http_request` to GET the profile page and check if the payload is rendered raw:\n    `grep \"\u003Cscript>alert(document.domain)\u003C\u002Fscript>\" response_body.txt`\n\n### 9. Alternative Approaches\n*   **Custom Textarea:** If the default `about_me` is patched or restricted, create a *new* custom field of type \"Textarea\" via the UM Form Builder (Admin dashboard), assign it a meta key (e.g., `my_custom_bio`), and repeat the exploit. The vulnerability applies to \"Non-HTML Custom Textarea\" fields generally.\n*   **Payload Variation:** If `\u003Cscript>` is blocked, use attribute-based XSS:\n    `\">\u003Cimg src=x onerror=alert(1)>`\n*   **AJAX Endpoint:** Check if the profile can be updated via the UM AJAX handler `um_profile_update` if the standard form submission is restricted.","gemini-3-flash-preview","2026-07-25 09:56:36","2026-07-25 09:57:20",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","2.11.4","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fultimate-member\u002Ftags\u002F2.11.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fultimate-member.2.11.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fultimate-member\u002Ftags\u002F2.12.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fultimate-member.2.12.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fultimate-member\u002Ftags"]