The plugin function get_user_profile_structure() assembles the front‑end profile buffer, including raw comment excerpts that are then passed to WordPress's shortcode engine after a limited neutralization pass. Authenticated users with Subscriber-level access or higher can inject arbitrary shortcodes into comment bodies; when any visitor views the target's front‑end profile 'Comments' tab, the attacker‑supplied shortcodes are executed on the server. This can trigger any shortcode available in active plugins or themes, allowing the injection of arbitrary HTML, disclosure of protected data via capability‑gated shortcodes, or execution of privileged plugin functions, thereby compromising confidentiality, integrity, and availability of the site.

The vulnerability affects the WP User Avatar / ProfilePress plugin as delivered by properfraction, in all releases up to and including version 4.17.5. WordPress sites that rely on this plugin for user registration, login, or restricted content, and have Subscriber‑level users who can post comments, are vulnerable until the vendor releases an update.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score is currently unavailable, but the absence of a KEV listing suggests no known large‑scale exploitation. The attack requires an authenticated Subscriber and the ability to post a comment, which is commonly granted on most WordPress installations. Therefore, anyone who can comment on a user profile can supply a malicious shortcode that will execute for any visitor viewing that profile’s Comments tab, creating a broad audience for the injected payload. The entire risk surface is limited to front‑end profile pages and shortcodes available in the site's active plugins or theme.