Ultimate Member is a popular WordPress plugin for user profiles, registration, and member directories, with over 200,000 active installations. If you’re running version 2.11.1 or earlier, you’re vulnerable to a reflected cross-site scripting (XSS) vulnerability that could allow an attacker to steal session cookies or inject malicious content into the page.
What’s the vulnerability?
The Members List page has a sorting feature that accepts user input via GET parameters. The plugin fails to properly escape this input when displaying it back in the HTML, creating a reflected XSS vulnerability.
Here’s the vulnerable code in templates/members.php (line 310):
<a href="javascript:void(0);" class="um-member-directory-sorting-a-text"><?php echo $sorting_options[ $sort_from_url ] ?></a>The $sort_from_url variable comes from the URL parameter sort_abc123 (where abc123 is the directory hash). Whilst the plugin does sanitise the input with sanitize_text_field(), it doesn’t escape the output with esc_html(). This means an attacker can inject HTML and JavaScript.
How does the attack work?
An attacker crafts a malicious URL and tricks a user into clicking it. For example:
https://yoursite.com/members/?sort_abc123=<img src=x onerror="alert('XSS')">When a user clicks the link, the JavaScript executes in their browser. A real attack would steal session cookies, inject a fake login form, or redirect to a malicious site.
If an admin or editor is targeted, the attacker could potentially escalate privileges or inject persistent malware.
Who’s affected?
- Ultimate Member versions 2.11.1 and earlier
- Any site with the Members List shortcode visible to anonymous users
- Requires user interaction (clicking a malicious link), but that’s easily achieved via phishing or social engineering
What should you do?
Update immediately. Ultimate Member 2.11.2, released on 2026-02-20, fixes this vulnerability by adding proper output escaping:
<?php echo esc_html( $sorting_options[ $sort_from_url ] );
If you can’t update right now:
- Check your Ultimate Member version in WordPress admin (Plugins → Installed Plugins)
- If you’re on 2.11.1 or earlier, update to 2.11.2 or later
- Test the Members List page after updating to ensure it still works
If you’re managing multiple WordPress sites, automated vulnerability monitoring catches these before they become a problem. Tools like Vulnz can alert you when plugins on your network have known vulnerabilities.
The lesson
This is a classic case of “sanitise input, escape output.” The plugin did one but not the other. In WordPress, sanitize_text_field() removes dangerous characters but doesn’t prevent HTML injection. You always need esc_html() when outputting user-supplied data in an HTML context.
If you’re developing WordPress plugins, remember: sanitisation is for input validation, escaping is for output safety. Use both.
Update now, and you’re safe.