Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via My Account Display Name
- ID
- WPSEC-2026-2305
- Plugin
- ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content (wp-user-avatar)
- Affected
- from 3.0 before 4.18.0
- Remediation
- Update to 4.18.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-94
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-03
- Attack surface
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content on WPSec AttackSurface
- Fix released
- Published
Description
The ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution via the display-name dropdown on the My Account edit-profile page in all versions up to, and including, 4.17.7. This is due to the plugin printing the user's nickname, first name, last name and display name into the dropdown without escaping them or neutralizing square brackets, then passing the assembled form markup through do_shortcode(). Saved values are cleaned only by stripping complete shortcodes from each field separately, so pieces split across fields (for example the first name and last name, which the dropdown joins into one option) come back together as a working shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes and see their output.
References
- https://wpsec.com/vuln/WPSEC-2026-2305/
- https://plugins.svn.wordpress.org/wp-user-avatar/tags/4.18.0/
- https://wordpress.org/plugins/wp-user-avatar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS