# Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via My Account Display Name

- **ID:** WPSEC-2026-2305
- **Plugin:** ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content (`wp-user-avatar`), https://wordpress.org/plugins/wp-user-avatar/
- **Affected versions:** from 3.0 before 4.18.0
- **Fixed in:** 4.18.0 (Update to 4.18.0 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-user-avatar
- **Fix released:** 2026-10-31
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2305/

## Description

The ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution via the display-name dropdown on the My Account edit-profile page in all versions up to, and including, 4.17.7. This is due to the plugin printing the user's nickname, first name, last name and display name into the dropdown without escaping them or neutralizing square brackets, then passing the assembled form markup through do_shortcode(). Saved values are cleaned only by stripping complete shortcodes from each field separately, so pieces split across fields (for example the first name and last name, which the dropdown joins into one option) come back together as a working shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes and see their output.

## References

- https://wpsec.com/vuln/WPSEC-2026-2305/
- https://plugins.svn.wordpress.org/wp-user-avatar/tags/4.18.0/
- https://wordpress.org/plugins/wp-user-avatar/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2305/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.