CVE-2018-10234: Ultimatemember User Profile & Membership

Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days.

Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=um_options&section=account page.

Affected products

• Ultimatemember User Profile & Membership: before 2.0.11 (fixed in 2.0.11)

Published 2018-04-23. Last modified 2026-06-17.