Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-92551 · Microsoft / collected KEV context

cve-program · CVE-2026-92551

• https://www.wordfence.com/threat-intel/vulnerabilities/id/269dd459-c857-49ed-b5d6-8c9e946ac590?source=cve
• https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.4/src/Widgets/TabbedWidget.php#L108
• https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.4/src/Classes/FileUploader.php#L24
• https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.4/src/Classes/FileUploader.php#L97
• https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.4/src/Classes/RegistrationAuth.php#L285
• https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.17.4/src/Widgets/TabbedWidgetDependency.php#L92
• https://pastebin.com/raw/AEJW3cKe

No related operational record is retained in the current change model.