PT-2026-30346 · WordPress · Profilepress

Nabil Irawan · Published 2026-04-04 · Updated 2026-04-04 · CVE-2026-3309

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ProfilePress versions through 4.16.11

Description The ProfilePress plugin for WordPress is susceptible to arbitrary shortcode execution. This occurs because the plugin doesn't properly sanitize user-supplied billing field values during the checkout process before using them in shortcode template strings. This allows unauthenticated attackers to execute arbitrary shortcodes by submitting crafted billing field values.

Recommendations Update to a version beyond 4.16.11

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-3309

Affected Products

Profilepress

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-3309 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3471623%40wp-user-avatar%2Ftrunk&old=3447273%40wp-user-avatar%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/2040481238902038754 · Twitter Post
• https://twitter.com/cyberbivash/status/2040418190467957050 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/3f8f083e-0de2-42a5-b289-101ec53aa44c?source=cve · Note