ProfilePress EUVD-2026-91891

Exploitation requires that a page on the target site hosts the ProfilePress Tabbed Widget, which exposes the vulnerable ppress_billing_address file upload field; sites not using this widget are not exposed. The attacker (unauthenticated per PR:N) must send a crafted POST request with a malicious filename and then trick a logged-in or targeted user into clicking the resulting link or performing the triggering action (UI:R) - the payload is reflected, not stored, so there is no persistent exposure and each victim must be individually lured. Affected versions are all releases up to and including 4.17.4.

This is a moderate-severity reflected XSS (CVSS 6.1, CWE-79). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N confirms network-reachable, low-complexity, unauthenticated access, but exploitation hinges on user interaction (UI:R) - a victim must be tricked into clicking a crafted link, which is the single largest factor lowering real-world risk. The scope change (S:C) and Low confidentiality/integrity impacts reflect that the payload executes in the victim's browser context rather than compromising the server directly. No EPSS score, no CISA KEV entry, and no SSVC decision data were supplied, so automatability and exploitation-maturity signals cannot be weighed; however, one reference points to a Pastebin raw paste (pastebin.com/raw/AEJW3cKe) that appears to host proof-of-concept exploit code. Reflected XSS requiring per-victim social engineering is typically targeted rather than wormable, so despite the unauthenticated network vector this should be treated as a patch-in-normal-cycle priority rather than an emergency, with elevated urgency only for high-traffic sites that deploy the ProfilePress Tabbed Widget. No conflicting signals were found between the description and the CVSS vector.

An attacker crafts a POST request to a page hosting the ProfilePress Tabbed Widget, placing a malicious script payload in the filename of the ppress_billing_address file upload field, and embeds this in a link sent to a victim. When the victim clicks the link, the unsanitized filename is reflected into the page and the script executes in their browser, potentially stealing session cookies or performing actions as that user. Proof-of-concept code appears to be publicly posted (Pastebin reference), and because UI:R is required the attack depends on successful social engineering.