diff --git a/changelog.txt b/changelog.txt
index e372666a..55827620 100644
--- a/changelog.txt
+++ b/changelog.txt
@@ -2,7 +2,7 @@
 
 = 2.11.1 December xx, 2025 =
 
-
+Fixed: CVE-2025-13217
 
 = 2.11.0 December 02, 2025 =
 
diff --git a/includes/core/um-filters-fields.php b/includes/core/um-filters-fields.php
index 98d1c299..9904db3f 100644
--- a/includes/core/um-filters-fields.php
+++ b/includes/core/um-filters-fields.php
@@ -76,15 +76,15 @@ function um_profile_field_filter_hook__youtube_video( $value, $data ) {
 	}
 	$value = ( strstr( $value, 'http' ) || strstr( $value, '://' ) ) ? um_youtube_id_from_url( $value ) : $value;
 	if ( false !== $value ) {
+		$value = 'https://www.youtube.com/embed/' . $value;
 		$value = '<div class="um-youtube">'
-			. '<iframe width="600" height="450" src="https://www.youtube.com/embed/' . $value . '" frameborder="0" allowfullscreen></iframe>'
+			. '<iframe width="600" height="450" src="' . esc_url( $value ) . '" frameborder="0" allowfullscreen></iframe>'
 			. '</div>';
 	}
 	return $value;
 }
 add_filter( 'um_profile_field_filter_hook__youtube_video', 'um_profile_field_filter_hook__youtube_video', 99, 2 );
 
-
 /**
  * Outputs a spotify iframe
  *
@@ -127,8 +127,9 @@ function um_profile_field_filter_hook__vimeo_video( $value, $data ) {
 	}
 
 	$value = ! is_numeric( $value ) ? (int) substr( parse_url( $value, PHP_URL_PATH ), 1 ) : $value;
+	$value = 'https://player.vimeo.com/video/' . $value;
 	$value = '<div class="um-vimeo">
-					<iframe src="https://player.vimeo.com/video/' . $value . '" width="600" height="450" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe>
+					<iframe src="' . esc_url( $value ) . '" width="600" height="450" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe>
 					</div>';
 	return $value;
 }
@@ -199,14 +200,14 @@ function um_profile_field_filter_hook__googlemap( $value, $data ) {
 	if ( ! $value ) {
 		return '';
 	}
+	$value = 'https://maps.google.it/maps?q=' . urlencode( $value ) . '&output=embed';
 	$value = '<div class="um-googlemap">
-					<iframe width="600" height="450" frameborder="0" style="border:0" src="https://maps.google.it/maps?q=' . urlencode( $value ) . '&output=embed"></iframe>
+					<iframe width="600" height="450" frameborder="0" style="border:0" src="' . esc_url( $value ) . '"></iframe>
 				</div>';
 	return $value;
 }
 add_filter( 'um_profile_field_filter_hook__googlemap', 'um_profile_field_filter_hook__googlemap', 99, 2 );
 
-
 /**
  * User's registration date
  *
diff --git a/readme.txt b/readme.txt
index b00c2e6a..2152dca0 100644
--- a/readme.txt
+++ b/readme.txt
@@ -169,7 +169,7 @@ IMPORTANT: PLEASE UPDATE THE PLUGIN TO AT LEAST VERSION 2.6.7 IMMEDIATELY. VERSI
 
 = 2.11.1 2025-12-xx =
 
-
+Fixed: CVE-2025-13217
 
 = 2.11.0 2025-12-02 =