CVE-2025-15064

Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user description field in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only exploitable when "HTML support for user description" is enabled in Ultimate Member settings.

We have discovered 25,341 live websites that are affected by CVE-2025-15064.

Run a Free Instant Scan



Affected Software

Product  Ultimate Member
Category Wordpress Plugins
Vulnerable Domains25,341 live websites (61% of Ultimate Member install base)
Vulnerable Versions
  • from 0 through 2.11.1
Vulnerable Versions Count109 versions ( 98% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Apr 4, 2026
  • Updated - Apr 8, 2026

Credits

  • Kevin Wydler (finder)

Website Distribution by Country

Number of websites using CVE-2025-15064
United States6,531 websites


Germany3,132 websites
France1,958 websites
Italy1,230 websites
GB1,208 websites
Spain1,067 websites
Netherlands589 websites
Canada562 websites
Switzerland499 websites
India448 websites

Website Distribution by TLD

Number of websites using CVE-2025-15064
.com9,020 websites
.org2,595 websites
.de1,772 websites
.fr912 websites
.it848 websites
.net596 websites
.nl566 websites
.es520 websites
.co.uk516 websites
.ch386 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2025-15064

Top websites that are affected by CVE-2025-15064. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
******.com United States**,***
***********.net United States**,***
**********.org United States**,***
******.de United States**,***
**********.com United States**,***
********.com Canada**,***
*************.net United States**,***
********.**.il Israel**,***
*********.com United States**,***
**.ru Russia**,***
See full domain list

FAQ

CVE-2025-15064 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Ultimate Member
A total of 25,341 websites have been identified as vulnerable to CVE-2025-15064, based on global website indexing conducted by WebTechSurvey.
The Ultimate Member is affected by the CVE-2025-15064 vulnerability.
Ultimate Member versions up to and including 2.11.1 are vulnerable to CVE-2025-15064.