CVE-2026-96270

{
  "etk_id": "ETK-2026-457",
  "cve_id": "CVE-2026-96270",
  "display_id": "CVE-2026-96270",
  "ghsa_id": "GHSA-6phc-8h2j-74hw",
  "euvd_id": "EUVD-2026-91876",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in Ultimate Member for WordPress",
  "summary": "Ultimate Member for WordPress versions through 2.13.1 are affected by stored cross-site scripting. An unauthenticated attacker may cause script to run in an administrator's browser after submitting data that is later viewed in the affected user-record interface; public registration and an administrator viewing that record are required.",
  "mitigation": "Disable or restrict public registration until an update is available, and avoid opening untrusted or newly created user records in the administrative interface. Review and remove suspicious registration data where feasible.",
  "vendor": "ultimatemember",
  "product": "Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 2.13.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin",
      "purl": null
    }
  ],
  "cwes": [
    79
  ],
  "cvss_score": 7.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "epss_score": 0.0025,
  "epss_percentile": 0.1497,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 54.26119755,
  "t0_at": "2026-10-03T02:25:34.564000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-04T15:20:30.486000+00:00",
      "days": 1.5381472453703704,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T02:25:34.564000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-03T02:25:34.564000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T02:25:34.564000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96270"
    }
  }
}