CVE-2026-92551mediumCWE-79

CVE-2026-92551: medium-severity vulnerability in properfraction Paid Membership Plugin…

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter

Published

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.2%
exploitation probability
0.2%top 89% of all CVEs
observed exploitation
nono source reports it
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter in all versions up to, and including, 4.17.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is exploitable via any page hosting the ProfilePress Tabbed Widget by supplying a malicious filename for the ppress_billing_address file upload field in a crafted POST request.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
properfraction · Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Related CVEs — properfraction Paid Membership Plugin…

In the same product, most dangerous first.

CVE-2026-13352HIGHPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter ExpansionEPSS 1.1%CVE-2022-4697MEDIUMProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.7%CVE-2022-4698MEDIUMProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form SettingsEPSS 0.7%CVE-2026-85658HIGHPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)EPSS 0.7%CVE-2026-92536HIGHPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile FieldsEPSS 0.6%CVE-2024-1408MEDIUMProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcodeEPSS 0.6%
References
https://pastebin.com/raw/AEJW3cKehttps://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.4/src/Classes/FileUploader.php#L24https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.4/src/Classes/FileUploader.php#L97https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.4/src/Classes/RegistrationAuth.php#L285https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.4/src/Widgets/TabbedWidgetDependency.php#L92https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.4/src/Widgets/TabbedWidget.php#L108https://www.wordfence.com/threat-intel/vulnerabilities/id/269dd459-c857-49ed-b5d6-8c9e946ac590?source=cve