{
 "id": "WPSEC-2026-3088",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3088/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3088/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3088/index.md",
 "title": "ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content <= 4.18.0 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Password Reset 'key' and 'login' Parameters",
 "description": "The Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content plugin for WordPress is vulnerable to arbitrary shortcode execution via the password reset handler form in all versions up to, and including, 4.18.0. This is due to the raw 'key' and 'login' request parameters being placed into hidden fields that are HTML-escaped but do not have their shortcode brackets neutralized, before the form is passed through do_shortcode(). Only the sanitized values are checked against the reset key. This makes it possible for authenticated attackers, with subscriber-level access and above who can get a valid password reset key for their own account, to execute arbitrary shortcodes on the site.",
 "plugin": {
  "slug": "wp-user-avatar",
  "name": "ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content",
  "full_name": "ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content",
  "wordpress_org": "https://wordpress.org/plugins/wp-user-avatar/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-user-avatar/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-user-avatar"
 },
 "type": "UNKNOWN",
 "cwe": [
  "CWE-94"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.0",
    "from_inclusive": true,
    "to": "4.18.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.0 before 4.18.1"
  ]
 },
 "introduced_in": "3.0",
 "fixed_in": "4.18.1",
 "remediation": "Update to 4.18.1 or later.",
 "fix_released": "2026-11-12T16:16:36+00:00",
 "published": "2026-11-13T16:44:01+00:00",
 "updated": "2026-11-13T15:52:49.695117+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3088/",
  "https://plugins.svn.wordpress.org/wp-user-avatar/tags/4.18.1/",
  "https://wordpress.org/plugins/wp-user-avatar/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-user-avatar",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-11-13"
 }
}