CVE-2026-92551

Name of the Vulnerable Software and Affected Versions ProfilePress versions prior to 4.17.5

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when a malicious filename is supplied to the ppress billing address file upload field via a crafted POST request on any page hosting the ProfilePress Tabbed Widget. If a user is tricked into clicking a malicious link, arbitrary web scripts can be executed in their browser.

Recommendations Update to version 4.17.5 or later. Restrict access to the ProfilePress Tabbed Widget until the update is applied.