CVE-2026-92551: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress WordPress plugin is vulnerable to reflected cross-site scripting (XSS) via the ppress_billing_address filename parameter. This vulnerability affects all versions up to and including 4.17.4. An unauthenticated attacker can inject arbitrary scripts that execute when a user interacts with a crafted link on any page hosting the ProfilePress Tabbed Widget. The vulnerability arises from insufficient input sanitization and output escaping of the filename parameter in a file upload field.
AI Analysis
Technical Summary
CVE-2026-92551 describes a reflected cross-site scripting vulnerability in the ProfilePress plugin for WordPress, specifically via the ppress_billing_address filename parameter. The flaw exists in all versions up to 4.17.4 due to improper neutralization of input during web page generation, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires tricking a user into clicking a crafted link on pages hosting the ProfilePress Tabbed Widget, where the malicious filename is submitted in a POST request. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.1, indicating medium severity.
Potential Impact
Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to information disclosure and limited integrity impacts. The vulnerability does not impact availability. The reflected XSS could be used to hijack user sessions or perform actions on behalf of the user if they interact with maliciously crafted content.
Mitigation Recommendations
No official patch or fix is currently confirmed for this vulnerability. Users should check the vendor's advisory for updates. Until a fix is available, avoid exposing pages with the ProfilePress Tabbed Widget to untrusted users or disable the vulnerable file upload functionality if possible. Employ web application firewalls or other filtering mechanisms to detect and block malicious payloads targeting the ppress_billing_address parameter.
CVE-2026-92551: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Description
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress WordPress plugin is vulnerable to reflected cross-site scripting (XSS) via the ppress_billing_address filename parameter. This vulnerability affects all versions up to and including 4.17.4. An unauthenticated attacker can inject arbitrary scripts that execute when a user interacts with a crafted link on any page hosting the ProfilePress Tabbed Widget. The vulnerability arises from insufficient input sanitization and output escaping of the filename parameter in a file upload field.
CVSS v3.1
Score 6.1medium
Affected software
properfraction
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-92551 describes a reflected cross-site scripting vulnerability in the ProfilePress plugin for WordPress, specifically via the ppress_billing_address filename parameter. The flaw exists in all versions up to 4.17.4 due to improper neutralization of input during web page generation, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires tricking a user into clicking a crafted link on pages hosting the ProfilePress Tabbed Widget, where the malicious filename is submitted in a POST request. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.1, indicating medium severity.
Potential Impact
Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to information disclosure and limited integrity impacts. The vulnerability does not impact availability. The reflected XSS could be used to hijack user sessions or perform actions on behalf of the user if they interact with maliciously crafted content.
Mitigation Recommendations
No official patch or fix is currently confirmed for this vulnerability. Users should check the vendor's advisory for updates. Until a fix is available, avoid exposing pages with the ProfilePress Tabbed Widget to untrusted users or disable the vulnerable file upload functionality if possible. Employ web application firewalls or other filtering mechanisms to detect and block malicious payloads targeting the ppress_billing_address parameter.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-09-16T13:09:36.230Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac07aa9a43b0b3b89999cc9
Added to database: 10/03/2026, 03:46:49 UTC
Last enriched: 10/03/2026, 04:01:29 UTC
Last updated: 10/03/2026, 04:23:37 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.