---
id: "CVE-2026-104003"
kind: "vulnerability"
aliases: ["CVE-2026-104003"]
title: "WP User Avatar plugin: comment text runs shortcodes on profile pages"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "profilepress", "wordpress", "wp-user-avatar"]
not_affected_if: ["default-config"]
published_at: "2026-10-16T09:17:03+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:18:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104003", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# WP User Avatar plugin: comment text runs shortcodes on profile pages

WP User Avatar (ProfilePress) up to and including 4.17.5 passes raw user comment content to do_shortcode(), so a logged-in subscriber can post a comment containing a shortcode. The shortcode then runs on the server whenever a visitor opens the target's profile Comments tab, which can reach shortcodes from other plugins or themes and inject raw HTML into a public page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the WP User Avatar / ProfilePress plugin in the WordPress admin Plugins screen, or with `wp plugin get wp-user-avatar --field=version`
- Confirm whether user comments are enabled on profile pages in the plugin settings

## Fix

- Update the WP User Avatar / ProfilePress plugin to a version later than `4.17.5`; the fixed version number is unknown from the sources

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104003

## From the sources

The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the get_user_profile_structure() function assembling the front-end profile buffer — which includes raw comment excerpts inlined by author_comment_query() — and passing the entire buffer to do_shortcode() after only a narrow neutralization pass (ppress_neutralize_buffer_shortcodes) that blocks pp-custom-html and bracket fragments containing HTML delimiters but leaves any other well-formed shortcode intact. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary shortcodes (from any active plugin or theme) with attacker-chosen attributes by posting a comment whose body contains the shortcode markup; the shortcode is then executed server-side when any visitor loads the target's front-end profile Comments tab, letting the attacker reach capability-gated or data-returning shortcodes and inject raw HTML markup into a publicly viewable page.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_