CVE-2026-19848— ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display Name
Quick assessment
Affected
Unknown ProfilePress
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 ProfilePress WordPress 插件 4.17.1 版本之前，该插件在将其两个配置文件字段在公共页面上呈现之前，未对这些字段中的短代码进行剥离处理。这一缺陷允许未经身份验证的攻击者存储短代码，这些短代码在页面被查看时将被执行，从而泄露指定用户的电子邮件地址、登录时间和注册时间。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1133 · External Remote ServicesAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | ProfilePress | < 4.17.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-19848
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display Name
Source: CVE Program / CVE List V5
Vulnerability Description
The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login and registration date.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | ProfilePress | 0 ~ 4.17.1 | - |
|
II. Public POCs for CVE-2026-19848
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19848
请登录查看更多情报信息。
Other References for CVE-2026-19848 (1)
-
🔗 ProfilePress < 4.17.1 – Unauthenticated Arbitrary Shortcode Execution via Display Name | CVE 2026-19848 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-08-21 · 20 CVEs total
| CVE-2026-17559 | 5.3 MEDIUM | Content Protector (Passster) < 4.3.9 - Unauthenticated Protected Content Disclosure via RE |
| CVE-2026-16650 | 5.3 MEDIUM | Charitable < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webh |
| CVE-2026-15150 | 5.3 MEDIUM | myCred < 3.2.5 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verificati |
| CVE-2026-15046 | 4.2 MEDIUM | LitExtension: Store to WooCommerce Migration <= 1.2.5 - Connector Token Takeover via CSRF |
| CVE-2026-18356 | 3.7 LOW | Limit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Acco |
| CVE-2026-13176 | 2.7 LOW | Eventin < 4.1.21 - Contributor+ Server-Side Request Forgery |
| CVE-2026-13736 | NewPath WildApricotPress Add-on – Member Directory <= 1.0.0 - Unauthenticated Member PII D | |
| CVE-2025-15671 | Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter | |
| CVE-2026-14325 | Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via dr | |
| CVE-2026-14601 | Link Whisper < 0.9.7 - Editor+ SQL Injection via domain Parameter | |
| CVE-2026-16576 | Dokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API | |
| CVE-2026-16962 | Tamara Checkout <= 1.9.9.20 - Unauthenticated Order Status Manipulation | |
| CVE-2026-16575 | Dokan < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST | |
| CVE-2026-19085 | Copy & Delete Posts < 1.5.6 - Author+ Password-Protected Post Content Disclosure | |
| CVE-2026-19435 | Copy & Delete Posts < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure | |
| CVE-2026-18781 | Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via | |
| CVE-2026-16959 | Media Library Assistant < 3.40 - Author+ SQL Injection via mla_search_connector | |
| CVE-2026-16577 | Dokan < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount | |
| CVE-2026-75796 | AI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP |
IV. Related Vulnerabilities
Same product: ProfilePress
-
CVE-2026-41556
WordPress ProfilePress plugin <= 4.16.13 - Cross Site Script -
CVE-2023-41953
WordPress ProfilePress plugin <= 4.13.1 - Broken Access Cont -
CVE-2023-50882
WordPress ProfilePress plugin <= 4.13.2 - Broken Access Cont -
CVE-2023-41954
WordPress ProfilePress plugin <= 4.13.1 - Unauthenticated Li -
CVE-2023-23830
WordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cros
Same vendor: Unknown
-
CVE-2026-77115
Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS -
CVE-2026-77116
Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup -
CVE-2026-77003
Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capabilit -
CVE-2026-14853
WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Pr -
CVE-2026-13598
RestrictMate < 1.3.0 - Unauthenticated Privilege Escalation
V. Comments for CVE-2026-19848
No comments yet