CVE-2026-18385

Name of the Vulnerable Software and Affected Versions ProfilePress versions prior to 4.16.20

Description Authenticated attackers with subscriber-level access and above can execute arbitrary shortcodes. This occurs because the software fails to properly validate values before executing the do shortcode() function. The issue persists despite partial mitigations using strip shortcodes() on [profile-first-name] and [profile-last-name], as these can be bypassed via the [profile-display-name format="first last names"] render path, the [profile-bio] render path, or the double-bracket escape sequence [[tag]].

Recommendations Update to a version newer than 4.16.19.