The ProfilePress WordPress plugin before version 4.17.1 fails to strip or escape shortcodes entered into two profile fields before rendering them on public pages. Because the stored shortcodes are executed on page load, an unauthenticated attacker can embed a shortcode that discloses user information such as the email address, login name, and registration date. The vulnerability therefore allows the attacker to gather sensitive profile data from any publicly displayed profile without needing to compromise the site administrator or gain privileged access.

Vulnerable systems are installations of the ProfilePress WordPress plugin, specifically any version earlier than 4.17.1. The issue affects the profile fields that render user display information on public profile pages, making all public profile views exploitable if the shortcode is present.

With a CVSS score of 6.5, the vulnerability is considered moderate; the exploitation is trivial for an attacker because no authentication is required and the payload is delivered simply by visiting the publicly accessible profile page. Although the EPSS score is not available, the fact that the flaw leverages a broad public reach and the capability to reveal personal identifiers indicates a real threat. The vulnerability is not listed in the CISA KEV catalog, but the potential for widespread information disclosure makes it a priority for timely remediation.