CVE-2026-92551 properfraction CVE debrief

Who should care

Defenders responsible for WordPress installations using the ProfilePress plugin, particularly those with the ProfilePress Tabbed Widget, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-92551 is a Reflected Cross-Site Scripting vulnerability in the ProfilePress plugin for WordPress. Defenders should prioritize verifying the presence of this vulnerability in their installations, assessing exposure of the ProfilePress Tabbed Widget, and implementing input sanitization and output escaping for the ppress_billing_address Filename Parameter. Successful exploitation could allow injection of arbitrary web scripts, and remediation priority is high for WordPress installations with the vulnerable plugin version.

• Defenders must verify the presence of this vulnerability in their WordPress installations
• Exposure of the ProfilePress Tabbed Widget to potential cross-site scripting attacks requires assessment
• Successful exploitation could allow injection of arbitrary web scripts
• Remediation priority is high for WordPress installations with the vulnerable plugin version

Technical summary

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ppress_billing_address Filename Parameter in all versions up to, and including, 4.17.4. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure of the ProfilePress Tabbed Widget.

Recommended defensive actions

• Verify the presence of the ProfilePress plugin version 4.17.4 or earlier in your WordPress installation
• Assess exposure of the ProfilePress Tabbed Widget to potential cross-site scripting attacks
• Implement input sanitization and output escaping for the ppress_billing_address Filename Parameter
• Consider upgrading to a patched version of the ProfilePress plugin if available
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability is confirmed to exist in versions up to and including 4.17.4 of the ProfilePress plugin. The source references provided include links to the vulnerable code in the plugin's GitHub repository.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.