Skip to contentProperfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – Profilepress vulnerabilities
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendere…CVE-2026-1040035.4 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename ParameterCVE-2026-925516.1 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection vi…CVE-2026-925368.8 High
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Fie…CVE-2026-856588.1 High
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name…CVE-2026-183855.4 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter ExpansionCVE-2026-133528.8 High
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan SubscriptionCVE-2026-49494.3 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fi…CVE-2026-33096.5 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payme…CVE-2026-34457.1 High
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/ExpirationCVE-2026-34538.1 High
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode ExecutionCVE-2025-136425.4 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode ExecutionCVE-2025-88786.5 Medium
- properfraction profilepress, profilepress loginwp, properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress +2 moreProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information ExposureCVE-2024-110835.3 Medium
- properfraction profilepress, paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress +1 moreProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel WidgetCVE-2024-28616.4 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, profilepress +1 morePaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-28676.4 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, profilepress +1 morePaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'reg-sing…CVE-2024-32106.4 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, profilepress +1 moreProfilePress <= 4.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile ShortcodeCVE-2024-18066.4 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, profilepress +1 morePaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via [reg-sele…CVE-2024-14096.4 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, profilepress +1 moreProfilePress <= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeCVE-2024-15356.4 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, profilepress +1 moreProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcodeCVE-2024-14086.4 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, profilepress +1 moreProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeCVE-2024-15706.4 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, profilepress +1 morePaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.4 - Unauthenticated Stored Cross-Site ScriptingCVE-2024-15196.5 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, profilepress +1 morePaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-10466.4 Medium
- profilepress membership team paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, properfraction profilepress +1 moreWordPress ProfilePress Plugin <= 4.3.2 is vulnerable to PHP Object InjectionCVE-2022-450836.6 Medium
- properfraction profilepress, paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress +1 moreProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site ScriptingCVE-2022-46975.5 Medium
- properfraction profilepress, paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress +1 moreProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form SettingsCVE-2022-46985.5 Medium