CVE-2026-92551

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-03

Last updated on: 2026-10-06

Assigner: Wordfence

Description

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter in all versions up to, and including, 4.17.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is exploitable via any page hosting the ProfilePress Tabbed Widget by supplying a malicious filename for the ppress_billing_address file upload field in a crafted POST request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-03

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-03

EPSS Evaluated

2026-10-18

NVD

CVE-2026-92551

EUVD

EUVD-2026-91891

Affected Vendors & Products

Vendor	Product	Version / Range
properfraction	Paid	Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Reflected Cross-Site Scripting (XSS) issue in the ProfilePress WordPress plugin. It occurs due to insufficient input sanitization and output escaping in the ppress_billing_address filename parameter. Attackers can inject malicious scripts into web pages by tricking users into clicking a crafted link. The exploit is possible via the ProfilePress Tabbed Widget when a malicious filename is supplied in a POST request.

Detection Guidance

Check for the ProfilePress plugin versions up to 4.17.4. Inspect POST requests targeting the ppress_billing_address parameter for unusual filenames or script injections. Monitor for unexpected script execution in pages hosting the ProfilePress Tabbed Widget.

Impact Analysis

Unauthenticated attackers could execute arbitrary web scripts in your browser if you interact with a malicious link. This could lead to session hijacking, theft of cookies, or redirection to phishing sites. Users with admin access could have their accounts compromised, potentially allowing full site takeover.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in data breaches, unauthorized data access, or disclosure, potentially leading to regulatory fines or penalties.

Mitigation Strategies

Update the ProfilePress plugin to the latest version beyond 4.17.4. If an update is unavailable, disable the plugin temporarily. Implement input sanitization for the ppress_billing_address parameter and restrict file uploads to trusted sources.

Hi! I’m here to help you understand CVE-2026-92551. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70