CVE-2026-19848

ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display Name

The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login and registration date.

We have discovered 43,049 live websites that are affected by CVE-2026-19848.

Run a Free Instant Scan



Affected Software

Product  ProfilePress
Category Wordpress Plugins
Vulnerable Domains43,049 live websites (100% of ProfilePress install base)
Vulnerable Versions
  • from 0 through 4.17.1
Vulnerable Versions Count131 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')



Details

  • Published - Aug 21, 2026
  • Updated - Aug 21, 2026

Credits

  • Jakub Herman (finder)
  • WPScan (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-19848
United States14,304 websites


Japan4,911 websites
Germany4,193 websites
France2,179 websites
Italy1,727 websites
GB1,583 websites
Spain1,085 websites
Brazil1,076 websites
Netherlands953 websites
Poland904 websites

Website Distribution by TLD

Number of websites using CVE-2026-19848
.com20,063 websites
.de2,354 websites
.org2,335 websites
.net1,530 websites
.it1,331 websites
.com.br1,007 websites
.jp875 websites
.nl838 websites
.co.uk817 websites
.fr769 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-19848

Top websites that are affected by CVE-2026-19848. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*********.com France*,***
********.com United States*,***
********.com United States*,***
*********.com United States*,***
*******.com Canada*,***
*********.com United States*,***
************.org United States*,***
*******.com United States*,***
******.com United States*,***
**********.com United States**,***
See full domain list

FAQ

CVE-2026-19848 is Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in ProfilePress
A total of 43,049 websites have been identified as vulnerable to CVE-2026-19848, based on global website indexing conducted by WebTechSurvey.
The ProfilePress is affected by the CVE-2026-19848 vulnerability.
ProfilePress versions up to 4.17.1 are vulnerable to CVE-2026-19848.
CVE-2026-19848 is resolved in version 4.17.1 of ProfilePress.