Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the filter parameters (e.g., 'filter_first_name') in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-1404 Reflected XSS in Ultimate Member WordPress Plugin via Filter Parameters https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1404
Post summary
The text announces a reflected XSS vulnerability (CVE-2026-1404) in the Ultimate Member WordPress plugin, providing a basic technical description but no PoC, exploit, patch, or exploitation evidence.
CVE-2026-1404 The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Reflected Cross… https://www.cve.org/CVERecord?id=CVE-2026-1404
Post summary
The text announces CVE‑2026‑1404 as a Reflected XSS vulnerability in the Ultimate Member WordPress plugin and links to the official CVE record, with no additional details on PoC, exploit, or mitigation.