ProfilePress < 4.17.1 Unauthenticated Arbitrary Shortcode Execution via Display Name (CVE-2026-19848)

Vulnerability Overview Vulnerability Name: ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display Name Description: The plugin fails to strip shortcodes from its two profile fields before rendering public pages, allowing unauthenticated attackers to store shortcodes that are executed when the page is viewed, thereby disclosing the email addresses, usernames, and registration dates of specific users. CVE Number: CVE-2026-19848 Classification: - Type: INJECTION - OWASP Top 10: A1: Injection - CVSS Score: 6.5 (Medium) Affected Scope Affected Plugin: wp-user-avatar Fixed Version: 4.17.1 Remediation Fixed Version: Upgrade to version 4.17.1 or higher Timeline Public Disclosure Date: 2026-08-19 Added Date: 2026-08-19 Last Updated: 2026-08-19 Additional Information Original Researcher: Jakub Herman Submitter: Jakub Herman Submitter Website: https://jakubherman.net Verification Status: Yes WPVDB ID: 362f4ed7-9637-4786-a72b-a48e9a12b9ff References CVE: CVE-2026-19848 Related Vulnerabilities Element Pack Addons for Elementor < 8.3.16: Unauthenticated Email Header Injection via element_pack_contact_form Form Maker by WD < 1.12.24: CSV Injection Ninja Forms < 3.6.26: Admin+ Stored HTML Injection HTTP Headers <= 1.19.2: Administrator+ CRLF Injection via Custom Header Values Eventin < 4.1.21: Contributor+ Server-Side Request Forgery POC Code POC Code: The page states that the POC will be displayed on September 02, 2026, to give users time to update. The specific code is not provided on the current page.

Goal Reached Thanks to every supporter — we hit 100%!

ProfilePress < 4.17.1 Unauthenticated Arbitrary Shortcode Execution via Display Name (CVE-2026-19848)

More from this source