PeproDev Ultimate Profile Solutions <= 8.3.0 - Reflected Cross-Site Scripting via 'section' Parameter
- ID
- WPSEC-2026-2654
- Plugin
- PeproDev Ultimate Profile Solutions (peprodev-ups)
- Affected
- all versions before 8.3.20
- Remediation
- Update to 8.3.20 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-06
- Attack surface
- PeproDev Ultimate Profile Solutions on WPSec AttackSurface
- Fix released
- Published
Description
The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'section' parameter of the user profile dashboard in all versions up to, and including, 8.3.0, due to insufficient output escaping. The value is only passed through sanitize_text_field(), which keeps quotes, and is then printed raw into the class attributes of the dashboard wrapper and into an inline JavaScript template literal. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can successfully trick a logged-in user into clicking a crafted link.
References
- https://wpsec.com/vuln/WPSEC-2026-2654/
- https://plugins.svn.wordpress.org/peprodev-ups/tags/8.3.20/
- https://wordpress.org/plugins/peprodev-ups/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS