CVE-2026-92551: ProfilePress WordPress Plugin XSS Vulnerability

CVE-2026-92551 Overview

CVE-2026-92551 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the ProfilePress plugin for WordPress, also known as Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content. The flaw affects all plugin versions up to and including 4.17.4. It stems from insufficient input sanitization and output escaping of the ppress_billing_address file upload field filename. Unauthenticated attackers can inject arbitrary web scripts that execute when a victim clicks a crafted link. Exploitation requires any page on the target site to host the ProfilePress Tabbed Widget.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, account takeover, and redirection to attacker-controlled infrastructure.

Affected Products

ProfilePress plugin for WordPress (slug: wp-user-avatar) versions ≤ 4.17.4
WordPress sites rendering the ProfilePress Tabbed Widget on any public page
Deployments exposing the ppress_billing_address file upload field to unauthenticated requests

Discovery Timeline

2026-10-03 - CVE-2026-92551 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-92551

Vulnerability Analysis

The vulnerability resides in ProfilePress's file upload handling path. When a request submits a file to the ppress_billing_address field, the plugin reflects the user-supplied filename back into the response without proper sanitization or output escaping. An attacker can supply a filename containing HTML or JavaScript payloads, which the server then echoes into a page rendered by the Tabbed Widget. Because the reflection occurs in a response to an unauthenticated POST request, no account credentials are required. User interaction is required: a victim must be enticed to submit the crafted request, typically through a malicious link or auto-submitting form hosted on an attacker-controlled page.

Root Cause

The root cause is missing input sanitization and output encoding on the filename value extracted from the ppress_billing_address upload field. The processing logic in src/Classes/FileUploader.php, src/Classes/RegistrationAuth.php, and the Tabbed Widget rendering code in src/Widgets/TabbedWidget.php and src/Widgets/TabbedWidgetDependency.php treats the filename as trusted content. This design flaw allows attacker-controlled markup to flow directly into HTML context in the rendered page.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a POST request to a WordPress page that renders the ProfilePress Tabbed Widget, supplying a malicious filename value for the ppress_billing_address upload field. When a victim is tricked into triggering the request, the injected script executes in the context of the victim's browser session on the vulnerable site. The scope-changed impact enables theft of session cookies, forged actions on behalf of authenticated users, and phishing redirects. Technical references are available in the Wordfence Vulnerability Analysis and the ProfilePress FileUploader source.

Detection Methods for CVE-2026-92551

Indicators of Compromise

POST requests to pages hosting the ProfilePress Tabbed Widget containing ppress_billing_address form fields with filenames embedding <script>, onerror=, onload=, or similar HTML event handlers
HTTP referrers originating from unexpected external domains preceding ProfilePress form submissions
Response bodies that reflect ppress_billing_address filename content inline within widget markup

Detection Strategies

Inspect web server and WordPress access logs for POST requests to pages rendering the Tabbed Widget that include suspicious filename parameters
Deploy a Web Application Firewall (WAF) ruleset that blocks requests whose multipart file metadata contains HTML tags or JavaScript event handlers
Audit installed plugin versions to identify ProfilePress installations at or below version 4.17.4

Monitoring Recommendations

Monitor for anomalous outbound requests from administrator browsers to unknown domains after visiting content containing the Tabbed Widget
Alert on new or modified WordPress administrator accounts and session anomalies following suspected XSS activity
Enable Content Security Policy (CSP) reporting to capture blocked inline script execution attempts

How to Mitigate CVE-2026-92551

Immediate Actions Required

Update the ProfilePress plugin to a version above 4.17.4 as soon as a fixed release is available
Remove or temporarily unpublish any pages or sidebars containing the ProfilePress Tabbed Widget until the plugin is patched
Rotate WordPress administrator credentials and invalidate active sessions if suspicious reflected content has been observed

Patch Information

At the time of NVD publication, all ProfilePress versions through 4.17.4 are affected. Monitor the Wordfence advisory and the WordPress plugin repository for the fixed release and apply it across all WordPress sites.

Workarounds

Remove the ProfilePress Tabbed Widget from all public-facing pages, sidebars, and widget areas to eliminate the exploitation surface
Deploy WAF rules that reject multipart form submissions containing HTML or JavaScript characters in file metadata fields
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins

bash

# Example WAF rule concept to block script payloads in ppress_billing_address filename
# ModSecurity-style pseudo rule
SecRule FILES_NAMES "@rx (?i)(<script|onerror=|onload=|javascript:)" \
  "id:1092551,phase:2,deny,status:403,msg:'Blocked XSS attempt in ppress_billing_address filename (CVE-2026-92551)'"