# PeproDev Ultimate Profile Solutions <= 8.3.0 - Reflected Cross-Site Scripting via 's' Parameter

- **ID:** WPSEC-2026-2650
- **Plugin:** PeproDev Ultimate Profile Solutions (`peprodev-ups`), https://wordpress.org/plugins/peprodev-ups/
- **Affected versions:** all versions before 8.3.20
- **Fixed in:** 8.3.20 (Update to 8.3.20 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-06)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/peprodev-ups
- **Fix released:** 2026-11-05
- **Published:** 2026-11-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2650/

## Description

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter of the admin dashboard sections panel in all versions up to, and including, 8.3.0, due to insufficient output escaping. The search term is only passed through sanitize_text_field() and is then echoed raw inside the value attribute of the search input. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can successfully trick an administrator into clicking a crafted link.

## References

- https://wpsec.com/vuln/WPSEC-2026-2650/
- https://plugins.svn.wordpress.org/peprodev-ups/tags/8.3.20/
- https://wordpress.org/plugins/peprodev-ups/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2650/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.