CVE-2026-4791: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in peprodev PeproDev Ultimate Profile Solutions

CVE-2026-4791 is a stored cross-site scripting vulnerability in the PeproDev Ultimate Profile Solutions plugin for WordPress. The vulnerability arises from insufficient input sanitization and output escaping of the 'button' attribute in the 'logout-url' shortcode. Authenticated attackers with contributor-level privileges or higher can exploit this to inject arbitrary web scripts into pages, which execute in the context of users who access those pages. The vulnerability affects all plugin versions from 0 up to and including 8.2.36.

Successful exploitation allows an attacker with contributor-level or higher access to inject persistent malicious scripts into pages. These scripts execute in the browsers of users who visit the injected pages, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impact on confidentiality and integrity but no impact on availability.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level and higher user privileges to trusted users only and consider disabling or removing the affected shortcode if possible.