Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Reflected Cross-Site Scripting via 'start_date' and 'end_date' Parameters
- ID
- WPSEC-2026-0398
- Plugin
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress (wp-user-avatar)
- Affected
- from 4.0.0 before 4.17.6
- Remediation
- Update to 4.17.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content on WPSec AttackSurface
- Fix released
- Published
Description
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'start_date' and 'end_date' parameters in all versions up to, and including, 4.17.5. This is due to insufficient output escaping of the date filter values on the membership Customers, Orders and Subscriptions admin pages. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.
References
- https://wpsec.com/vuln/WPSEC-2026-0398/
- https://plugins.svn.wordpress.org/wp-user-avatar/tags/4.17.6/
- https://wordpress.org/plugins/wp-user-avatar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS