Arbitrary Shortcode Execution Vulnerability in WP User Avatar / ProfilePress WordPress Plugin
CVE-2026-104003

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – Profilepress
Vendor
CVE Published:
16 October 2026

What is CVE-2026-104003?

The WP User Avatar / ProfilePress plugin for WordPress has a vulnerability that allows authenticated users, specifically those with Subscriber-level access or above, to execute arbitrary shortcodes. This vulnerability arises from inadequate filtering of comments that contain shortcode markup. The get_user_profile_structure() function processes the user profile buffer, allowing attackers to include shortcode attributes of their choice within a comment. When the Comments tab on the front-end profile is accessed by any visitor, these shortcodes are executed server-side, potentially exposing sensitive data or enabling the injection of raw HTML into publicly viewable pages.

Affected Version(s)

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress 0 <= 4.17.5

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-user-avatar...
https://plugins.trac.wordpress.org/browser/wp-user-avatar...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kuba
.