CVE-2024-1570 in ProfilePress Plugin
Summary
by MITRE • 02/29/2024
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's login-password shortcode in all versions up to, and including, 4.14.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/12/2026
The vulnerability identified as CVE-2024-1570 affects the ProfilePress plugin for WordPress, specifically targeting the login-password shortcode functionality within versions up to and including 4.14.4. This represents a critical security flaw that undermines the integrity of user authentication systems and exposes websites to potential exploitation by malicious actors. The issue stems from inadequate input sanitization and output escaping mechanisms that fail to properly validate and sanitize user-supplied attributes before processing them within the plugin's shortcode implementation.
The technical flaw manifests through a stored cross-site scripting vulnerability that allows authenticated attackers with contributor-level permissions or higher to inject malicious scripts into the plugin's shortcode attributes. When these attributes are processed and rendered in subsequent page requests, the injected scripts execute within the context of other users' browsers who access pages containing the compromised shortcode. This vulnerability operates under the CWE-79 classification as a classic stored XSS flaw, where malicious input is permanently stored on the server and subsequently executed without proper sanitization or escaping mechanisms. The attack vector specifically targets the plugin's shortcode processing logic which fails to implement proper context-aware output escaping for user-supplied parameters.
The operational impact of this vulnerability extends beyond simple script injection, as it provides attackers with the capability to escalate privileges, steal user sessions, or redirect victims to malicious domains. Contributors and above have sufficient permissions to modify plugin settings and insert malicious code through the shortcode interface, potentially compromising all users who interact with affected pages. The vulnerability affects the core authentication and user management functionality of the plugin, making it particularly dangerous for websites that rely on ProfilePress for membership management and user access control. Attackers could leverage this weakness to harvest session cookies, execute malicious commands, or establish persistent backdoors within the compromised WordPress environment, with implications for data integrity and user privacy.
Mitigation strategies for CVE-2024-1570 should prioritize immediate plugin updates to versions that address the XSS vulnerability through proper input validation and output escaping implementations. Organizations should implement network monitoring to detect suspicious shortcode usage patterns and consider restricting contributor-level user permissions until the vulnerability is fully patched. The ATT&CK framework categorizes this vulnerability under T1059.001 for command and scripting interpreter and T1566.001 for spearphishing attachment, highlighting the potential for privilege escalation and initial access exploitation. Security measures should include regular security audits of plugin configurations, implementation of web application firewalls to filter malicious payloads, and comprehensive user access reviews to minimize the attack surface. Additionally, administrators should enforce strict input validation policies and consider implementing Content Security Policy headers to limit script execution capabilities within the affected WordPress environment.