WordPress Plugin Vulnerabilities

ProfilePress < 4.17.3 - Subscriber+ Arbitrary Shortcode Execution via 'eup_bio' Biography Field

Description

The plugin is vulnerable to arbitrary shortcode execution due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.

Affects Plugins

Plugin icon
wp-user-avatar
Fixed in 4.17.3

References

CVE
CVE-2026-85658
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/b8486d1d-8a76-446e-867b-8db32499ebf8

Classification

Type
RCE
OWASP top 10
A1: Injection
CWE
CWE-94
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Md. Moniruzzaman Prodhan (NomanProdhan)
Verified
No
WPVDB ID
fe7809e5-1671-4246-8634-ff45426ebe99

Timeline

Publicly Published
2026-09-18 (about 29 days ago)
Added
2026-09-18 (about 28 days ago)
Last Updated
2026-09-18 (about 28 days ago)

Other

Published
Title
Published
2026-09-24
Title
CartFlows < 3.2.1 - Contributor+ RCE
Published
2015-10-23
Title
Form Manager <= 1.7.2 - Authenticated Remote Command Execution (RCE)
Published
2022-02-03
Title
Ad Inserter < 2.7.11 - Admin+ RCE / Stored XSS
Published
2026-06-26
Title
Auros Core <= 5.3.1 - Unauthenticated Arbitrary Shortcode Execution
Published
2026-09-21
Title
WP Ultimate Review < 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter