Ultimate Profile Solutions CVE-2026-4791

Requires an authenticated WordPress account with contributor-level privileges or above (PR:L) - the attacker must be able to author content and insert shortcodes. The specific trigger is the button attribute of the logout-url shortcode, which is stored without input sanitization and rendered without output escaping; the payload fires when any user subsequently accesses the page containing that shortcode. Key limiting factors: sites that do not permit untrusted user registration or restrict contributor accounts to trusted staff have substantially reduced exposure, and exploitation depends on a privileged user actually viewing the injected page.

This is a medium-severity stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) that is best treated as a moderate, not top-tier, priority. The CVSS vector shows network reachability and low attack complexity, but PR:L confirms authentication is required - specifically contributor-level access - which materially limits the attacker population to users who already have some trusted role on the site. The scope change (S:C) and low confidentiality/integrity impact reflect that injected script executes in other users' browser sessions, including potentially administrators, enabling session/account compromise within the WordPress context. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active exploitation or widespread automated weaponization; this appears to be a vendor/researcher-disclosed issue (Wordfence) rather than an in-the-wild threat. The signals are consistent rather than conflicting: a genuine but gated vulnerability. Note that for stored XSS the victim must load the injected page, which arguably warrants UI:R rather than the UI:N in the supplied vector - a point worth verifying, as it would lower the real-world score slightly.

An attacker who holds (or registers for) a contributor account on a vulnerable WordPress site inserts the logout-url shortcode into a post or page with a malicious payload in its 'button' attribute. Because the attribute is neither sanitized on input nor escaped on output, the script is stored and then runs in the browser of any user - including an editor or administrator reviewing or visiting the page - allowing session hijacking or actions performed as the victim. No public exploit identified at time of analysis.