wp-user-avatar <= 4.16.19 Authenticated Arbitrary Shortcode Execution via Profile Fields (CVE-2026-18385)

Vulnerability Overview Vulnerability Name: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field CVE ID: CVE-2026-18385 CVSS Score: 5.4 (Medium) Published Date: August 15, 2026 Last Updated Date: August 16, 2026 Researchers: stealthopter, Kishan Vyas Affected Scope Affected Versions: <= 4.16.19 Software Type: Plugin Software Slug: wp-user-avatar (view on wordpress.org) Fix Status: Yes Fixed Version: 4.17.0 Remediation Recommendation: Update to version 4.17.0 or later patched version. Vulnerability Description This vulnerability allows authenticated attackers (Subscriber level and above) to execute arbitrary shortcodes. Partial mitigation via the function was bypassed in the and rendering paths. Attackers can leverage the rendering path and double-bracket escape sequences to execute arbitrary shortcodes. References plugins.trac.wordpress.org Share Options Facebook X (Twitter) LinkedIn Email Other Information Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support with a 1-hour response time Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved License: Used under the license terms of Defiant Inc. Contact Information Technical Support: info@support@wordfence.com Additional Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media X Facebook LinkedIn Instagram Products and Services Products Support News About Subscription Stay Updated Sign up for news and updates from our panel of experienced security professionals. Footer Links Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscription Form Email: you@example.com Agree to Terms and Privacy Policy Register Button SIGN UP Footer Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Disclaimer: The content of this page is copyrighted and may not be copied, distributed, or modified without permission. Summary This vulnerability allows authenticated attackers to execute arbitrary shortcodes, affecting versions <= 4.16.19. It is recommended to update to version 4.17.0 or higher to resolve this issue.

Goal Reached Thanks to every supporter — we hit 100%!

wp-user-avatar <= 4.16.19 Authenticated Arbitrary Shortcode Execution via Profile Fields (CVE-2026-18385)

More from this source