CVE-2026-4791

Name of the Vulnerable Software and Affected Versions PeproDev Ultimate Profile Solutions versions prior to 8.2.37

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user-supplied attributes. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts via the 'button' attribute of the logout-url shortcode. These scripts execute whenever a user accesses the affected page.

Recommendations Update PeproDev Ultimate Profile Solutions to version 8.2.37 or later. As a temporary mitigation, restrict the ability of users with contributor-level access to edit pages or use the logout-url shortcode.