CVE-2026-41556

MEDIUM6.5JSON export Create alert

Description

Subscriber Cross Site Scripting (XSS) in ProfilePress <= 4.16.13 versions.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Affected products

properfraction / ProfilePressn/a – 4.16.13

References

MISChttps://patchstack.com/database/wordpress/plugin/wp-user-avatar/vulnerability/wordpress-profilepress-plugin-4-16-13-cross-site-scripting-xss-vulnerability?_s_id=cve