{
 "id": "WPSEC-2026-2305",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2305/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2305/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2305/index.md",
 "title": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via My Account Display Name",
 "description": "The ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution via the display-name dropdown on the My Account edit-profile page in all versions up to, and including, 4.17.7. This is due to the plugin printing the user's nickname, first name, last name and display name into the dropdown without escaping them or neutralizing square brackets, then passing the assembled form markup through do_shortcode(). Saved values are cleaned only by stripping complete shortcodes from each field separately, so pieces split across fields (for example the first name and last name, which the dropdown joins into one option) come back together as a working shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes and see their output.",
 "plugin": {
  "slug": "wp-user-avatar",
  "name": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content",
  "full_name": "ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content",
  "wordpress_org": "https://wordpress.org/plugins/wp-user-avatar/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-user-avatar/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-user-avatar"
 },
 "type": "RCE",
 "cwe": [
  "CWE-94"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.0",
    "from_inclusive": true,
    "to": "4.18.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.0 before 4.18.0"
  ]
 },
 "introduced_in": "3.0",
 "fixed_in": "4.18.0",
 "remediation": "Update to 4.18.0 or later.",
 "fix_released": "2026-10-31T09:37:07+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:38:40.321514+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2305/",
  "https://plugins.svn.wordpress.org/wp-user-avatar/tags/4.18.0/",
  "https://wordpress.org/plugins/wp-user-avatar/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-user-avatar",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-11-03"
 }
}