{
 "id": "WPSEC-2026-2650",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2650/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2650/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2650/index.md",
 "title": "PeproDev Ultimate Profile Solutions <= 8.3.0 - Reflected Cross-Site Scripting via 's' Parameter",
 "description": "The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter of the admin dashboard sections panel in all versions up to, and including, 8.3.0, due to insufficient output escaping. The search term is only passed through sanitize_text_field() and is then echoed raw inside the value attribute of the search input. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can successfully trick an administrator into clicking a crafted link.",
 "plugin": {
  "slug": "peprodev-ups",
  "name": "PeproDev Ultimate Profile Solutions",
  "full_name": "PeproDev Ultimate Profile Solutions",
  "wordpress_org": "https://wordpress.org/plugins/peprodev-ups/",
  "advisories_url": "https://wpsec.com/vuln/plugin/peprodev-ups/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/peprodev-ups"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "8.3.20",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 8.3.20"
  ]
 },
 "introduced_in": null,
 "fixed_in": "8.3.20",
 "remediation": "Update to 8.3.20 or later.",
 "fix_released": "2026-11-05T09:05:42+00:00",
 "published": "2026-11-06T12:43:54+00:00",
 "updated": "2026-11-06T12:03:19.245905+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2650/",
  "https://plugins.svn.wordpress.org/peprodev-ups/tags/8.3.20/",
  "https://wordpress.org/plugins/peprodev-ups/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/peprodev-ups",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-06"
 }
}