CVE-2026-19848
ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display Name
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login and registration date.
| Vendor | unknown |
| Product | profilepress |
| Published | Aug 21, 2026 |
| Last Updated | Aug 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown profilepress
Be the first to know when new medium vulnerabilities affecting unknown profilepress are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / ProfilePress
0 < 4.17.1
References
Credits
Jakub Herman WPScan