Properfraction Profilepress vulnerabilities

• profilepress membership team profilepress WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability CVE-2026-119473 4.3 MediumNovember 7, 2026
• profilepress membership team profilepress WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability CVE-2026-39733 5.3 MediumNovember 7, 2026
• properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendere… CVE-2026-104003 5.4 MediumOctober 16, 2026
• profilepress membership team profilepress WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability CVE-2026-96518 5.9 MediumOctober 9, 2026
• profilepress membership team profilepress WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability CVE-2026-96337 6.5 MediumOctober 9, 2026
• properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter CVE-2026-92551 6.1 MediumOctober 3, 2026
• properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection vi… CVE-2026-92536 8.8 HighOctober 3, 2026
• properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Fie… CVE-2026-85658 8.1 HighSeptember 19, 2026
• properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name… CVE-2026-18385 5.4 MediumAugust 16, 2026
• properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion CVE-2026-13352 8.8 HighJuly 17, 2026
• profilepress membership team profilepress WordPress ProfilePress plugin <= 4.16.13 - Cross Site Scripting (XSS) vulnerability CVE-2026-41556 6.5 MediumJune 15, 2026
• properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription CVE-2026-4949 4.3 MediumApril 15, 2026
• properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fi… CVE-2026-3309 6.5 MediumApril 4, 2026
• properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payme… CVE-2026-3445 7.1 HighApril 4, 2026
• properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration CVE-2026-3453 8.1 HighMarch 11, 2026
• properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution CVE-2025-13642 5.4 MediumDecember 9, 2025
• properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution CVE-2025-8878 6.5 MediumAugust 16, 2025
• unknown paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content, properfraction profilepress +1 more Paid Membership Plugin < 4.15.20 - Admin+ Stored XSS CVE-2024-13121 3.5 LowFebruary 13, 2025
• properfraction profilepress, unknown paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content +1 more ProfilePress < 4.15.20 - Admin+ Stored XSS CVE-2024-13120 4.8 MediumFebruary 13, 2025
• properfraction profilepress, unknown paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content +1 more ProfilePress < 4.15.20 - Admin+ Stored XSS CVE-2024-13119 4.8 MediumFebruary 13, 2025
• properfraction profilepress, unknown paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content +1 more ProfilePress < 4.15.15 - Admin+ Stored XSS CVE-2024-10518 4.8 MediumDecember 12, 2024
• properfraction profilepress, unknown paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content +1 more ProfilePress < 4.15.15 - Admin+ Stored XSS CVE-2024-10517 4.8 MediumDecember 12, 2024
• profilepress WordPress ProfilePress plugin <= 4.13.1 - Broken Access Control vulnerability CVE-2023-41953 5.3 MediumDecember 9, 2024
• profilepress WordPress ProfilePress plugin <= 4.13.2 - Broken Access Control vulnerability CVE-2023-50882 5.3 MediumDecember 9, 2024
• properfraction profilepress, profilepress loginwp, properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress +2 more ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure CVE-2024-11083 5.3 MediumNovember 27, 2024
• profilepress, profilepress team pro +1 more ProfilePress - Pro <= 4.11.1 - Authentication Bypass via WordPress.com OAuth provider CVE-2024-9947 8.1 HighOctober 23, 2024
• properfraction profilepress, paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress +1 more ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget CVE-2024-2861 6.4 MediumMay 23, 2024
• profilepress membership team profilepress WordPress ProfilePress plugin <= 4.13.1 - Unauthenticated Limited Privilege Escalation vulnerability CVE-2023-41954 8.6 HighMay 17, 2024
• properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, profilepress +1 more Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.4 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-2867 6.4 MediumMay 2, 2024
• properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, profilepress +1 more Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'reg-sing… CVE-2024-3210 6.4 MediumApril 10, 2024
• properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, profilepress +1 more ProfilePress <= 4.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode CVE-2024-1806 6.4 MediumMarch 13, 2024
• properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, profilepress +1 more Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via [reg-sele… CVE-2024-1409 6.4 MediumMarch 13, 2024
• properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, profilepress +1 more ProfilePress <= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-1535 6.4 MediumMarch 13, 2024
• properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, profilepress +1 more ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcode CVE-2024-1408 6.4 MediumFebruary 20, 2024
• properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, profilepress +1 more ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-1570 6.4 MediumFebruary 20, 2024
• properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, profilepress +1 more Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.4 - Unauthenticated Stored Cross-Site Scripting CVE-2024-1519 6.5 MediumFebruary 20, 2024
• properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, profilepress +1 more Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-1046 6.4 MediumFebruary 5, 2024
• profilepress membership team paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, properfraction profilepress +1 more WordPress ProfilePress Plugin <= 4.3.2 is vulnerable to PHP Object Injection CVE-2022-45083 6.6 MediumJanuary 19, 2024
• profilepress membership team paid membership plugin, ecommerce, registration form, login form, user profile & restrict content – profilepress, properfraction profilepress, profilepress user registration\, login form\, user profile \& membership +2 more WordPress ProfilePress Plugin <= 4.13.2 is vulnerable to Sensitive Data Exposure CVE-2023-44150 7.5 HighNovember 30, 2023
• profilepress membership team profilepress WordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS) CVE-2023-23830 7.1 HighMay 3, 2023
• profilepress membership team profilepress WordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS) CVE-2023-23820 6.5 MediumMay 3, 2023
• profilepress membership team profilepress WordPress ProfilePress Plugin <= 4.5.3 is vulnerable to Cross Site Scripting (XSS) CVE-2023-23996 5.9 MediumApril 6, 2023
• profilepress membership team paid membership plugin, ecommerce, registration form, login form, user profile & restrict content – profilepress, properfraction profilepress +1 more WordPress ProfilePress Plugin <= 4.4.1 is vulnerable to Cross Site Scripting (XSS) CVE-2022-47444 7.1 HighMarch 29, 2023
• properfraction profilepress, paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress +1 more ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2022-4697 5.5 MediumDecember 23, 2022
• properfraction profilepress, paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress +1 more ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form Settings CVE-2022-4698 5.5 MediumDecember 23, 2022
• properfraction profilepress, unknown user registration, user profile, login & membership – profilepress (formerly wp user avatar) +1 more ProfilePress < 3.1.11 - Unauthenticated Cross-Site Scripting (XSS) in tabbed login/register widget CVE-2021-24522 6.1 MediumAugust 9, 2021
• properfraction profilepress, unknown user registration, user profiles, login & membership – profilepress (formerly wp user avatar) +1 more ProfilePress < 3.1.8 - Authenticated Stored XSS CVE-2021-24450 4.8 MediumAugust 2, 2021
• profilepress ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in File Uploader Component CVE-2021-34624 9.8 CriticalJuly 7, 2021
• profilepress ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation CVE-2021-34621 Public exploit EPSS 68.9% 9.8 CriticalJuly 7, 2021
• profilepress ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in Image Uploader Component CVE-2021-34623 9.8 CriticalJuly 7, 2021
• Show olderLoading…