Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content

ID

WPSEC-2026-0403

Plugin

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress (wp-user-avatar)

Affected

from 3.0 before 4.17.6

Remediation

Update to 4.17.6 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness

CWE-94

Usage

Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22

Attack surface

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content on WPSec AttackSurface

Fix released

2026-10-02

Published

2026-10-03

Description

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.17.5. This is due to the user profile's comments list inserting excerpts of the user's comments, without neutralizing shortcodes, into profile output that is processed by do_shortcode(). This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes when the comments on their profile are viewed. Exploitation requires one of the attacker's comments to be approved.

References

• https://wpsec.com/vuln/WPSEC-2026-0403/
• https://plugins.svn.wordpress.org/wp-user-avatar/tags/4.17.6/
• https://wordpress.org/plugins/wp-user-avatar/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS