The ProfilePress plugin is vulnerable to arbitrary shortcode execution due to insufficient sanitization of the type parameter in the form preview feature. Authenticated users with Subscriber level or higher can trigger the pp_preview_form endpoint and inject arbitrary shortcodes, which may result in unintended code execution or data disclosure. This weakness is classified as CWE‑94 and represents a moderate severity flaw (CVSS 5.4).

This issue affects all releases of the Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress up to and including version 4.16.7. The vulnerability is linked to the properfraction vendor and pertains to the WordPress plugin named ProfilePress.

The CVSS score of 5.4 indicates moderate risk, while the EPSS score of < 1% suggests exploitation is unlikely at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the attacker to be authenticated with at least Subscriber‑level access, as the endpoint is restricted to logged‑in users. Once authenticated, the attacker can construct arbitrary shortcodes and trigger their execution via the preview functionality, potentially leading to code execution depending on the shortcode payloads that the site accepts.