# CVE-2026-92551: ProfilePress reflected XSS in file upload filename parameter

Source: https://junglewise.ai/threats/cve-2026-92551-the-paid-membership-plugin-ecommerce-user-registration-form-login  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-03. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-92551 · Severity: medium · CVSS 6.1 · Published 2026-10-03

ProfilePress is a WordPress plugin that provides membership management, user registration, and ecommerce features. An attacker can inject malicious scripts through a crafted file upload request that executes in users' browsers when they visit affected pages, potentially stealing credentials or performing unauthorized actions.

Technologies: [ProfilePress](https://junglewise.ai/threats/technologies/profilepress). Vendors: [ProfilePress](https://junglewise.ai/threats/vendors/profilepress).

## Quick answers

**Is CVE-2026-92551 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92551 being exploited in the wild.

**How severe is CVE-2026-92551?** Medium severity, with a CVSS score of 6.1, published 3 October 2026.

**Which products and versions are affected?** ProfilePress up to and including 4.17.4.

**Is there a fix for CVE-2026-92551?** Yes: fixed in 4.17.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92551 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-92551?** Check whether you run ProfilePress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.17.5 or later

## Technical details

Reflected Cross-Site Scripting (XSS) vulnerability in the file upload handler due to insufficient input sanitization and output escaping of the ppress_billing_address filename parameter. The vulnerable code renders the unsanitized filename in error messages displayed to users. An unauthenticated attacker can craft a malicious POST request to any page hosting the ProfilePress Tabbed Widget; the victim need only click a link to trigger script execution.

## Affected products

- ProfilePress ProfilePress up to and including 4.17.4

## Timeline

- 2026-10-03: disclosed

## References

- [https://pastebin.com/raw/AEJW3cKe](https://pastebin.com/raw/AEJW3cKe)
- [https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.4/src/Classes/FileUploader.php](https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.4/src/Classes/FileUploader.php)

## Related threats

- [ProfilePress WordPress plugin missing authorization in checkout membership plan change](https://junglewise.ai/threats/cve-2026-123661-the-profilepress-wordpress-plugin-before-4-17-4-does-not-check)
- [ProfilePress WordPress plugin access control bypass via negative plan ID](https://junglewise.ai/threats/cve-2026-123657-the-profilepress-wordpress-plugin-before-4-17-6-does-not-reject)
- [ProfilePress WordPress plugin access control bypass via REST API](https://junglewise.ai/threats/cve-2026-123656-the-profilepress-wordpress-plugin-before-4-17-6-does-not)
- [ProfilePress plugin for WordPress sensitive information exposure](https://junglewise.ai/threats/cve-2026-92536-the-paid-membership-plugin-ecommerce-user-registration-form-login)
- [ProfilePress arbitrary shortcode execution](https://junglewise.ai/threats/cve-2026-85658-the-paid-membership-plugin-ecommerce-user-registration-form-login)