Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

ProfilePress may expose user email and registration dates

CVE-2026-19848 · published 2 months ago
Summary

The ProfilePress add‑on for WordPress versions before 4.17.1 lets anyone place special codes in a profile name that are run when the page is shown. This can reveal a chosen user's email address and the dates they signed up or last logged in. Update the plugin to the latest version or remove the affected fields to stop the exposure.

What to do
  • Update unknown profilepress to version 4.17.1 or later.
Affected software
VendorProductAffected versions
unknown profilepress < 4.17.1
Original advisory text
ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display Name
The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login and registration date.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-74Injection
Timeline
Published21 Aug 2026
Updated31 Oct 2026
First seen21 Aug 2026
Sources
CVE-2026-19848 · NVD
CVE-2026-19848 · MITRE
Track software like this
Free during beta