CVE-2026-39733

Description

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in properfraction ProfilePress wp-user-avatar allows Code Injection.This issue affects ProfilePress: from n/a through 4.17.7.

Overview

State: PUBLISHED
Assigner (CNA): Patchstack
CVSS severity: MEDIUM
CVSS score: 5.3 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Effective score: 5.3 / 10 MEDIUM source: CNA overview
CWE(s): CWE-80
Reserved: 2026-04-07
Published: 2026-11-07 08:42 UTC
Last updated: 2026-11-07 08:43 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39733.json

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-119000

EUVD enrichment is queued; refresh the page in a few seconds.

Affected products (1)

Vendor	Product	Versions	Platforms
properfraction	ProfilePress	`0` (affected)	—

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

https://patchstack.com/database/wordpress/plugin/wp-user-avatar/vulnerability/wordpress-profilepress-plugin-4-17-7-content-injection-vulnerability?_s_id=cve vdb-entry

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Remediations (10)

CVE Database Search & Remediation Guidance

web:cvedatabase.com

Search and analyze CVE vulnerabilities with instant access to CVSS scores, affected products, and remediation guidance.

2026-11-08 11:10 UTC
CISA Requires Federal Agencies to Patch Critical Vulnerabilities Within ...

web:cybersecuritynews.com

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued Binding Operational Directive (BOD) 26-04, titled "Prioritizing Security Updates Based on Risk," compelling all Federal Civilian Executive Branch (FCEB) agencies to remediate the most dangerous known exploited vulnerabilities within just three calendar days.

2026-11-08 11:10 UTC
CVE Vulnerabilities 2026: Critical Flaws & Fixes Hub

web:cyberupdates365.com

Track critical CVE vulnerabilities 2026 with verified enterprise patch guides. Fix zero-days across VMware, WordPress, Windows, and cloud infrastructure.

2026-11-08 11:10 UTC
Actively Exploited Ivanti EPMM CVE-2026-6973 Added to CISA KEV

web:dailysecurityreview.com

Ivanti disclosed CVE - 2026 -6973, an actively exploited RCE vulnerability in EPMM 12.8.0.0 and earlier. CISA set a May 10 federal remediation deadline.

2026-11-08 11:10 UTC
Remediate vulnerabilities | Security Advisory | NetScaler

web:docs.netscaler.com

NetScaler detects CVEs and provides remediation suggestions the same. This topic lists the remediations suggested for the following CVEs :

2026-11-08 11:10 UTC
Security Advisories and Bulletins | Microsoft Learn

web:learn.microsoft.com

In this library you will find the following security documents that have been released by the Microsoft Security Response Center (MSRC). The MSRC investigates all reports of security vulnerabilities affecting Microsoft products and services, and releases these documents as part of the ongoing effort ...

2026-11-08 11:10 UTC
Security Update Guide - Microsoft

web:msrc.microsoft.com

The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

2026-11-08 11:10 UTC
Microsoft Patch Tracker (November 2026): Exploit-Ranked | Senserva

web:senserva.com

Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.

2026-11-08 11:10 UTC
SAP Security Patch Day - October 2026

web:support.sap.com

On 13 th of October 2026 , SAP security patch day saw the release of 16 new security notes and 4 GitHub security advisories. There are 2 updates to previously released security notes.

2026-11-08 11:10 UTC
Patch Tuesday CVE Analysis, Month by Month - Lansweeper

web:www.lansweeper.com

Monthly Microsoft Patch Tuesday breakdowns: actively exploited CVEs , critical fixes, and what to patch first. Every release analyzed by the Lansweeper team.

2026-11-08 11:10 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-39733.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "wp-user-avatar",
          "product": "ProfilePress",
          "vendor": "properfraction",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.18.0",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.17.7",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Filip Kowalski | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-11-07T08:42:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in properfraction ProfilePress wp-user-avatar allows Code Injection.<p>This issue affects ProfilePress: from n/a through 4.17.7.</p>"
            }
          ],
          "value": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in properfraction ProfilePress wp-user-avatar allows Code Injection.This issue affects ProfilePress: from n/a through 4.17.7."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-242",
          "descriptions": [
            {
              "lang": "en",
              "value": "Code Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T08:43:43.055Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/wp-user-avatar/vulnerability/wordpress-profilepress-plugin-4-17-7-content-injection-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress ProfilePress plugin to the latest available version (at least 4.18.0)."
            }
          ],
          "value": "Update the WordPress ProfilePress plugin to the latest available version (at least 4.18.0)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-39733",
    "datePublished": "2026-11-07T08:42:42.190Z",
    "dateReserved": "2026-04-07T10:58:45.543Z",
    "dateUpdated": "2026-11-07T08:43:43.055Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}