What’s Vulnerable › Products
properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – vulnerabilities
49 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 23 published in the last 12 months.
Latest properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – vulnerabilities
- CVE-2026-104003 — Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab (CVSS 5.4)
- CVE-2026-96518 — WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability (CVSS 5.9)
- CVE-2026-96337 — WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability (CVSS 6.5)
- CVE-2026-92551 — Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter (CVSS 6.1)
- CVE-2026-92536 — Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields (CVSS 8.8)
- CVE-2026-85658 — Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket) (CVSS 8.1)
- CVE-2026-18385 — Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field (CVSS 5.4)
- CVE-2026-13352 — Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion (CVSS 8.8)
- CVE-2026-41556 — WordPress ProfilePress plugin <= 4.16.13 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2026-4949 — ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription (CVSS 4.3)
- CVE-2026-3309 — Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields (CVSS 6.5)
- CVE-2026-3445 — Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass (CVSS 7.1)
- CVE-2026-3453 — ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration (CVSS 8.1)
- CVE-2025-13642 — ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution (CVSS 5.4)
- CVE-2025-8878 — Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution (CVSS 6.5)
- CVE-2024-13121 — Paid Membership Plugin < 4.15.20 - Admin+ Stored XSS (CVSS 3.5)
- CVE-2024-13120 — ProfilePress < 4.15.20 - Admin+ Stored XSS (CVSS 4.8)
- CVE-2024-13119 — ProfilePress < 4.15.20 - Admin+ Stored XSS (CVSS 4.8)
- CVE-2024-10518 — ProfilePress < 4.15.15 - Admin+ Stored XSS (CVSS 4.8)
- CVE-2024-10517 — ProfilePress < 4.15.15 - Admin+ Stored XSS (CVSS 4.8)
- CVE-2023-41953 — WordPress ProfilePress plugin <= 4.13.1 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2023-50882 — WordPress ProfilePress plugin <= 4.13.2 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2024-11083 — ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (CVSS 5.3)
- CVE-2024-9947 — ProfilePress - Pro <= 4.11.1 - Authentication Bypass via WordPress.com OAuth provider (CVSS 9.8)
- CVE-2024-2861 — ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget (CVSS 5.4)