Vulnerabilities / PeproDev Ultimate Profile Solutions / WPSEC-2026-2650
PeproDev Ultimate Profile Solutions <= 8.3.0 - Reflected Cross-Site Scripting via 's' Parameter
Medium 6.1
CWE-79Fixed in 8.3.20
- ID
- WPSEC-2026-2650
- Plugin
- PeproDev Ultimate Profile Solutions (peprodev-ups)
- Affected
- all versions before 8.3.20
- Remediation
- Update to 8.3.20 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-06
- Attack surface
- PeproDev Ultimate Profile Solutions on WPSec AttackSurface
- Fix released
- Published
Description
The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter of the admin dashboard sections panel in all versions up to, and including, 8.3.0, due to insufficient output escaping. The search term is only passed through sanitize_text_field() and is then echoed raw inside the value attribute of the search input. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can successfully trick an administrator into clicking a crafted link.
References
- https://wpsec.com/vuln/WPSEC-2026-2650/
- https://plugins.svn.wordpress.org/peprodev-ups/tags/8.3.20/
- https://wordpress.org/plugins/peprodev-ups/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS