CVE-2026-4791 in Ultimate Profile Solutions Plugin
Summary
by MITRE • 10/10/2026
The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `logout-url` shortcode's 'button' attribute in all versions up to, and including, 8.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/10/2026
The PeproDev Ultimate Profile Solutions plugin for WordPress contains a critical security vulnerability affecting all versions up through 8.2.36. This flaw is classified as a Stored Cross-Site Scripting (XSS) issue, specifically identified under the Common Weakness Enumeration standard as CWE-79. The root cause lies in insufficient input sanitization and output escaping applied to user-supplied attributes within the plugin's shortcode functionality. Specifically, the vulnerability targets the button attribute of the logout-url shortcode. Because WordPress plugins often handle dynamic content from users with varying levels of access, this lack of proper validation allows malicious actors to inject arbitrary web scripts into stored data structures on the server side rather than just transient session data.
The operational impact of this vulnerability is significant because it enables authenticated attackers who possess contributor-level access or higher to execute code in the context of other users' browsers. Unlike reflected XSS, where the payload must be delivered via a crafted link, stored XSS persists within the application's database or content storage. Consequently, whenever any user accesses a page containing the compromised shortcode, the injected malicious script executes automatically. This can lead to severe consequences such as session hijacking, credential theft through keyloggers, defacement of website content, or using the victim's browser to perform actions on behalf of the authenticated user, thereby compromising the integrity and confidentiality of the WordPress environment.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Client-Side Scripting Injection (T1059) and potentially Account Manipulation if used to escalate privileges or maintain persistence through injected scripts that modify account settings. The ability for contributor-level users to exploit this means that even non-administrative accounts can be leveraged as a foothold for further attacks, highlighting the importance of strict role-based access control and input validation in WordPress plugin development.
To mitigate this vulnerability, administrators should immediately update the PeproDev Ultimate Profile Solutions plugin to version 8.2.37 or later, where these sanitization issues have been addressed by developers. For sites unable to upgrade immediately due to compatibility constraints, implementing a Web Application Firewall can provide an additional layer of defense by filtering out malicious script injections in HTTP requests. Furthermore, enforcing strict content security policies and ensuring that all user inputs are properly escaped before rendering is essential for preventing similar vulnerabilities across the WordPress ecosystem. Regular auditing of plugin code against CWE-79 standards helps maintain robust security postures against client-side injection attacks.