Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Unauthenticated Reflected Cross-Site Scripting via Member Directory Date Filter
- ID
- WPSEC-2026-0397
- Plugin
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress (wp-user-avatar)
- Affected
- from 3.0 before 4.17.6
- Remediation
- Update to 4.17.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content on WPSec AttackSurface
- Fix released
- Published
Description
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the member directory 'filters' query parameter in all versions up to, and including, 4.17.5. This is due to insufficient output escaping: the date filter value is echoed into an input's value attribute without escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if they trick a user into clicking a crafted link. Exploitation requires a member directory with date filters enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0397/
- https://plugins.svn.wordpress.org/wp-user-avatar/tags/4.17.6/
- https://wordpress.org/plugins/wp-user-avatar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS