CVE-2026-39733— WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability

Quick assessment

Affected

properfraction ProfilePress

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 ProfilePress 插件的 wp-user-avatar 功能中存在“网页中脚本相关 HTML 标签未正确中和（基础跨站脚本 XSS）”漏洞，可导致代码注入。该问题影响 ProfilePress 插件从未知版本至 4.17.7 版本。

CVSS 5.3 · Medium EPSS 0.19% · P9 Updated Nov 09, 2026

Possible ATT&CK Techniques 1 AI

T1059.007 · JavaScript

Affected Version Matrix 1

Vendor	Product	Version Range	Status
properfraction	ProfilePress	`≤ 4.17.7`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability

Source: CVE Program / CVE List V5

Vulnerability Description

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in properfraction ProfilePress wp-user-avatar allows Code Injection.This issue affects ProfilePress: from n/a through 4.17.7.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

Web页面中脚本相关HTML标签转义处理不恰当(基本跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
properfraction	ProfilePress	0 ~ 4.17.7	-

II. Public POCs for CVE-2026-39733

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-39733

请登录查看更多情报信息。

Vendor Pages for CVE-2026-39733 (1)

🔗 Content Injection in WordPress ProfilePress Plugin - Patchstack vdb-entry

https://www.cve.org/CVERecord?id=CVE-2026-39733

IV. Related Vulnerabilities

Same product: ProfilePress

Same vendor: properfraction

Same weakness: CWE-80