{
 "id": "WPSEC-2026-2304",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2304/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2304/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2304/index.md",
 "title": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.7 - Unauthenticated Arbitrary Shortcode Execution via Billing Fields",
 "description": "The ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution via customer and order billing fields in all versions up to, and including, 4.17.7. This is due to stored billing values being placed, with only strip_shortcodes() and esc_attr() applied (and the order's billing country with no escaping at all), into an [edit-profile-cpf ... value=\"...\"] string that is passed to do_shortcode() on the admin customer and order edit screens. Square brackets are not neutralized, so a value can close the wrapper shortcode early and start a new shortcode of the attacker's choice. This makes it possible for unauthenticated attackers who can register through checkout (and for logged-in customers) to inject shortcodes that run when an administrator views the customer's or order's billing details.",
 "plugin": {
  "slug": "wp-user-avatar",
  "name": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content",
  "full_name": "ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content",
  "wordpress_org": "https://wordpress.org/plugins/wp-user-avatar/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-user-avatar/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-user-avatar"
 },
 "type": "RCE",
 "cwe": [
  "CWE-94"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.0.0",
    "from_inclusive": true,
    "to": "4.18.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.0.0 before 4.18.0"
  ]
 },
 "introduced_in": "4.0.0",
 "fixed_in": "4.18.0",
 "remediation": "Update to 4.18.0 or later.",
 "fix_released": "2026-10-31T09:37:07+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:38:40.321514+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2304/",
  "https://plugins.svn.wordpress.org/wp-user-avatar/tags/4.18.0/",
  "https://wordpress.org/plugins/wp-user-avatar/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-user-avatar",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-11-03"
 }
}