{"metadata": {"vulnerability": "CVE-2026-104003", "count": 15, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-10-01T16:20:45.881Z", "date_only": false, "value": "2026-10-01T16:20:45.881Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-104003", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-01T16:35:57Z", "date_only": false, "value": "2026-10-01T16:35:57.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-104003", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-15T19:57:58Z", "date_only": false, "value": "2026-10-15T19:57:58.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-104003", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-16T08:27:43.226Z", "date_only": false, "value": "2026-10-16T08:27:43.226Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-104003", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T08:27:43.226Z", "date_only": false, "value": "2026-10-16T08:27:43.226Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-104003", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T08:32:35.297Z", "date_only": false, "value": "2026-10-16T08:32:35.297013Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117449657863268067", "record": "CVE-2026-104003", "field": "creation_timestamp", "uuid": "2f8a85bd-140c-43b2-929e-c8a4703f9666", "content": "CVE-2026-104003 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the get_user_profile_structure() function assembling the front-end profile buffer \u2014 which includes raw comment excerpts inlined by author_comment_query() \u2014 and passing the entire buffer to do_shortcode() after only a narrow neutralization pass (ppress_neutralize_buffer_shortcodes) that blocks pp-custom-html and bracket fragments containing HTML delimiters but leaves any other well-formed shortcode intact. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary shortcodes (from any active plugin or theme) with attacker-chosen attributes by posting a comment whose body contains the shortcode markup; the shortcode is then executed server-side when any visitor loads the target's front-end profile Comments tab, letting the attacker reach capability-gated or data-returning shortcodes and inject raw HTML markup into a publicly viewable page.\nhttps://www.cve.org/CVERecord?id=CVE-2026-104003https://www.wordfence.com/threat-intel/vulnerabilities/id/83adfbff-f625-4474-81b9-961c496d59a0?source=cvehttps://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.5/src/ShortcodeParser/FrontendProfileTag.php#L142https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.5/src/ShortcodeParser/Builder/FrontendProfileBuilder.php#L169https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.5/src/Themes/DragDrop/UserProfile/DefaultTemplate.php#L379https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.5/src/Functions/GlobalFunctions.php#L1768https://pastebin.com/raw/pCgrW6Pfhttps://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.6/src/ShortcodeParser/FrontendProfileTag.php#wordpress #properfraction #PaidMembershipPlugin,Ecommerce,UserRegistrationForm,LoginForm,UserProfile&RestrictContent\u2013ProfilePress#CVE_2026_104003#bot", "url": "https://infosec.exchange/users/cve/statuses/117449657863268067"}, {"timestamp": "2026-10-16T09:17:03Z", "date_only": false, "value": "2026-10-16T09:17:03Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-6C6H-GV8V-JJR7", "record": "GHSA-6C6H-GV8V-JJR7", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T09:17:03.843Z", "date_only": false, "value": "2026-10-16T09:17:03.843", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104003", "record": "FKIE_CVE-2026-104003", "field": "published"}, {"timestamp": "2026-10-16T09:30:30Z", "date_only": false, "value": "2026-10-16T09:30:30Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-6C6H-GV8V-JJR7", "record": "GHSA-6C6H-GV8V-JJR7", "field": "published"}, {"timestamp": "2026-10-16T09:30:30Z", "date_only": false, "value": "2026-10-16T09:30:30Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-6C6H-GV8V-JJR7", "record": "GHSA-6C6H-GV8V-JJR7", "field": "modified"}, {"timestamp": "2026-10-16T14:53:07.727Z", "date_only": false, "value": "2026-10-16T14:53:07.727463Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104003", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T14:53:07.727Z", "date_only": false, "value": "2026-10-16T14:53:07.727463Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104003", "record": "FKIE_CVE-2026-104003", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T14:59:31.371Z", "date_only": false, "value": "2026-10-16T14:59:31.371Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-104003", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T14:59:31.371Z", "date_only": false, "value": "2026-10-16T14:59:31.371Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104003", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T15:17:03.103Z", "date_only": false, "value": "2026-10-16T15:17:03.103", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104003", "record": "FKIE_CVE-2026-104003", "field": "lastModified"}]}