Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-96270 · Microsoft / collected KEV context

cve-program · CVE-2026-96270

• https://www.wordfence.com/threat-intel/vulnerabilities/id/5673f2b9-1c30-4ce0-8a8c-7580d0346cb9?source=cve
• https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.13.1/includes/um-short-functions.php#L980
• https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.13.1/includes/um-short-functions.php#L900
• https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.13.1/includes/admin/core/class-admin-builder.php#L1090
• https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.13.1/includes/core/class-form.php#L768
• https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.13.1/includes/core/class-form.php#L422
• https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.13.1/includes/core/class-user.php#L1447
• https://github.com/ultimatemember/ultimatemember/releases/tag/2.14.0

No related operational record is retained in the current change model.