CVE-2026-41556 Subscriber Cross Site Scripting (XSS) in ProfilePress <= 4.16.13 versions

Description

Subscriber Cross Site Scripting (XSS) in ProfilePress <= 4.16.13 versions.

Affected products and versions

Product	Affected versions	Fixed in
ProfilePress 4.16	earliest → 4.16.13	No fix stated

Other CVEs of ProfilePress

The 10 CVEs of ProfilePress →

CVE-2026-119473 WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability 4.3 Medium CVE-2026-39733 WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability 5.3 Medium CVE-2026-96518 Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly… 5.9 Medium CVE-2026-96337 Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly… 6.5 Medium