CVE-2026-11766

HighCVSS 8.0/10Last modified Jul 6, 2026

Description

The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profiles, allowing authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, including an administrator, views the affected profile.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
UnknownUltimate Member< 2.12.0

References

Timeline

Published
Jul 6, 2026
Last modified
Jul 6, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1176669.1Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an adversary in the middle to impCVE-2026-117678.8The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them andCVE-2026-1176776.5When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for `Chart.yaml` without limitingCVE-2026-1176795.1A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary script in a user's CVE-2026-1176802.1Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an unauthCVE-2026-1176818.0A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables TransporCVE-2026-1176859.1The OCI registry's cross-repository blob mount checked the target package against the token's `public-only` restriction, but checked the souCVE-2026-1176876.9Movable Type provided by Six Apart Ltd. contains a code injection vulnerability in its Dynamic Publishing functionality. By sending a speciaCVE-2026-1176885.3A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution. When a vault provCVE-2026-117698.8We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege eCVE-2026-1176919.1A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encodedCVE-2026-11779.8A weakness has been identified in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /kmf/save_folder.j
CVE-2026-11766: High severity, CVSS 8.0 | Vulnix