CVE-2026-19848

The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login and registration date.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://wpscan.com/vulnerability/362f4ed7-9637-4786-a72b-a48e9a12b9ff/

Configurations

No configuration.

History

16 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) El plugin de WordPress ProfilePress anterior a la versión 4.17.1 no elimina los shortcodes de dos de sus campos de perfil antes de renderizarlos en páginas públicas, lo que permite a atacantes no autenticados almacenar shortcodes que luego se ejecutan cuando se visualiza la página, revelando la dirección de correo electrónico, el inicio de sesión y la fecha de registro de un usuario elegido.

Information

Published : 2026-08-21 12:16

Updated : 2026-10-16 15:10

NVD link : CVE-2026-19848

Mitre link : CVE-2026-19848

CVE.ORG link : CVE-2026-19848

JSON object : View

Products Affected

No product.

CWE

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

{"id": "CVE-2026-19848", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19848", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T12:46:29.482208Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "contact@wpscan.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "contact@wpscan.com", "affectedData": [{"vendor": "Unknown", "product": "ProfilePress", "versions": [{"status": "affected", "version": "0", "lessThan": "4.17.1", "versionType": "semver"}], "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}]}], "published": "2026-08-21T12:16:24.980", "references": [{"url": "https://wpscan.com/vulnerability/362f4ed7-9637-4786-a72b-a48e9a12b9ff/", "source": "contact@wpscan.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-74"}]}], "descriptions": [{"lang": "en", "value": "The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login and registration date."}, {"lang": "es", "value": "El plugin de WordPress ProfilePress anterior a la versi\u00f3n 4.17.1 no elimina los shortcodes de dos de sus campos de perfil antes de renderizarlos en p\u00e1ginas p\u00fablicas, lo que permite a atacantes no autenticados almacenar shortcodes que luego se ejecutan cuando se visualiza la p\u00e1gina, revelando la direcci\u00f3n de correo electr\u00f3nico, el inicio de sesi\u00f3n y la fecha de registro de un usuario elegido."}], "lastModified": "2026-10-16T15:10:00.103", "sourceIdentifier": "contact@wpscan.com"}