Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via Uploaded Filename

ID

WPSEC-2026-0229

Plugin

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress (wp-user-avatar)

Affected

all versions before 4.17.5

Remediation

Update to 4.17.5 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness

CWE-79

Usage

Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22

Attack surface

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content on WPSec AttackSurface

Fix released

2026-09-21

Published

2026-10-02

Description

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the name of an uploaded file in all versions up to, and including, 4.17.4. This is due to the file uploader placing the original, unescaped filename into its invalid-file error message, which the plugin's Tabbed Widget echoes without output escaping after a registration attempt. Field keys such as ppress_billing_address are accepted as upload fields without any custom field being configured. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as submitting a crafted form. Exploitation requires user registration to be enabled and the Tabbed Widget to be placed on the site.

References

• https://wpsec.com/vuln/WPSEC-2026-0229/
• https://plugins.svn.wordpress.org/wp-user-avatar/tags/4.17.5/
• https://wordpress.org/plugins/wp-user-avatar/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS