Ultimate Member < 2.14.0 - Unauthenticated Stored XSS via 'form_id' Parameter

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the 'form_id' parameter due to insufficient input sanitization and output escaping. The injected payload is stored in the registering user's 'submitted' usermeta via update_user_meta() and is only triggered when an administrator opens the affected user record in the wp-admin Users modal, which inserts the unescaped output via jQuery .html(), allowing unauthenticated attackers to inject arbitrary web scripts that execute in the administrator's session.