Skip to content
Noroxi

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

wp-user-avatar · plugin

Known security vulnerabilities for Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress. Find out in seconds which version runs on your site with WP Lens.

33 known vulnerabilities

1 critical · 1 with public exploit code · latest Sep 19, 2026

Vulnerabilities

  • CVE-2026-66047→ 4.17.2

    ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE

    Critical 9.2

  • CVE-2026-13352

    Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File

    High 8.8

  • CVE-2023-41954

    WordPress ProfilePress plugin <= 4.13.1 - Unauthenticated Limited Privilege Escalation vulnerability

    High 8.6

  • CVE-2026-85658

    Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortco

    High 8.1

  • CVE-2026-3453

    ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration

    High 8.1

  • CVE-2023-44150

    WordPress ProfilePress Plugin <= 4.13.2 is vulnerable to Sensitive Data Exposure

    High 7.5

  • CVE-2022-45083

    WordPress ProfilePress Plugin <= 4.3.2 is vulnerable to PHP Object Injection

    High 7.2

  • CVE-2026-3445

    Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Missing Authorization to Auth

    High 7.1

  • CVE-2026-41556

    WordPress ProfilePress plugin <= 4.16.13 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2026-3309

    Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Sho

    Medium 6.5

  • CVE-2025-8878

    Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Sho

    Medium 6.5

  • CVE-2024-1519

    Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.4 - Unauthenticated Stored Cross-S

    Medium 6.1

  • CVE-2023-23830

    WordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS)

    Medium 6.1

  • CVE-2022-47444

    WordPress ProfilePress Plugin <= 4.4.1 is vulnerable to Cross Site Scripting (XSS)

    Medium 6.1

  • CVE-2026-18385

    Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortc

    Medium 5.4

  • CVE-2025-13642

    ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

    Medium 5.4

  • CVE-2024-2861

    ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget

    Medium 5.4

  • CVE-2024-2867

    Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.4 - Authenticated (Contributor+) S

    Medium 5.4

  • CVE-2024-3210

    Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.5 - Authenticated (Contributor+) S

    Medium 5.4

  • CVE-2024-1806

    ProfilePress <= 4.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode

    Medium 5.4

  • CVE-2024-1535

    ProfilePress <= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    Medium 5.4

  • CVE-2024-1409

    Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.0 - Authenticated (Contributor+) S

    Medium 5.4

  • CVE-2024-1570

    ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    Medium 5.4

  • CVE-2024-1408

    ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcode

    Medium 5.4

  • CVE-2024-1046

    Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.3 - Authenticated (Contributor+) S

    Medium 5.4

  • CVE-2023-23820

    WordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS)

    Medium 5.4

  • CVE-2023-41953

    WordPress ProfilePress plugin <= 4.13.1 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2023-50882

    WordPress ProfilePress plugin <= 4.13.2 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2024-11083

    ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure

    Medium 5.3

  • CVE-2023-23996

    WordPress ProfilePress Plugin <= 4.5.3 is vulnerable to Cross Site Scripting (XSS)

    Medium 4.8

  • CVE-2022-4698

    ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form Settings

    Medium 4.8

  • CVE-2022-4697

    ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

    Medium 4.8

  • CVE-2026-4949

    ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription

    Medium 4.3

← Back to directory