CVE-2018-16285: Userproplugin Userpro

Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days.

The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/admin-ajax.php.

Affected products

• Userproplugin Userpro: up to and including 4.9.23

Published 2018-09-06. Last modified 2026-06-17.