What is the CVSS score of CVE-2026-41556?

CVE-2026-41556 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

ProfilePress CVE-2026-41556

EUVD-2026-36809 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-15 Patchstack

GHSA-c4ch-mh98-q8x5

WordPress XSS Profilepress Wordpress Plugin Properfraction

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

PR:L reflects required subscriber account; S:C captures cross-user browser execution; A:N as XSS carries no realistic availability impact on the vulnerable system.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 23:04 vuln.today

DescriptionCVE.org

Subscriber Cross Site Scripting (XSS) in ProfilePress <= 4.16.13 versions.

AnalysisAI

Cross-site scripting in ProfilePress WordPress plugin versions up to and including 4.16.13 allows authenticated subscribers to inject malicious JavaScript payloads that execute in the browsers of other users - including administrators - who view affected content. The CVSS scope change (S:C) indicator confirms this is a stored or reflected XSS that crosses privilege boundaries, enabling low-privilege users to target higher-privilege accounts. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

ProfilePress (formerly WP User Avatar) is a WordPress membership and user profile plugin developed by Properfraction, identified by CPE cpe:2.3:a:properfraction:profilepress:*:*:*:*:*:*:*:*. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), indicating that user-supplied input from subscriber-level accounts is not properly sanitized or escaped before being rendered in HTML output. The CVSS scope change (S:C) metric strongly suggests this is a stored XSS scenario where a subscriber populates a profile field with a malicious payload, and that payload executes in the browser context of another user (e.g., a site administrator) who later views the profile. The affected WordPress plugin ecosystem context means exploitation requires only a registered subscriber account on the target site.

RemediationAI

Update the ProfilePress plugin to any version released after 4.16.13; however, an exact confirmed patched release version is not independently verifiable from the available input data - administrators should check the official WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-user-avatar/vulnerability/wordpress-profilepress-plugin-4-16-13-cross-site-scripting-xss-vulnerability for the current patched release. As an immediate compensating control, disable open subscriber registration on the WordPress site (Settings > General > uncheck 'Anyone can register') to eliminate the low-privilege account vector; note this will prevent new user self-registration as a trade-off. Additionally, restrict access to subscriber profile views by administrators until patched, and consider deploying a web application firewall (WAF) rule to filter XSS patterns in profile-related POST parameters as a secondary defense. Review existing subscriber accounts for suspicious payloads in profile fields.