Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

Güvenlik açıkları

• CVE-2026-66047kimlik doğrulamasız→ 4.17.2

  ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE

  Kritik 9.2

• CVE-2026-92536abone+≤ 4.17.4

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Informa

  Yüksek 8.8

• CVE-2026-13352yazar+≤ 4.16.18

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File

  Yüksek 8.8

• CVE-2023-41954kimlik doğrulamasız≤ 4.13.1

  WordPress ProfilePress plugin <= 4.13.1 - Unauthenticated Limited Privilege Escalation vulnerability

  Yüksek 8.6

• CVE-2026-85658abone+≤ 4.17.2

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortco

  Yüksek 8.1

• CVE-2026-3453abone+≤ 4.16.11

  ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration

  Yüksek 8.1

• CVE-2023-44150kimlik doğrulamasız≤ 4.13.2

  WordPress ProfilePress Plugin <= 4.13.2 is vulnerable to Sensitive Data Exposure

  Yüksek 7.5

• CVE-2022-45083yüksek yetki≤ 4.3.2

  WordPress ProfilePress Plugin <= 4.3.2 is vulnerable to PHP Object Injection

  Yüksek 7.2

• CVE-2026-3445abone+≤ 4.16.11

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Missing Authorization to Auth

  Yüksek 7.1

• CVE-2026-3309kimlik doğrulamasız≤ 4.16.11

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Sho

  Orta 6.5

• CVE-2025-8878kimlik doğrulamasız≤ 4.16.4

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Sho

  Orta 6.5

• CVE-2026-41556abone+≤ 4.16.13

  WordPress ProfilePress plugin <= 4.16.13 - Cross Site Scripting (XSS) vulnerability

  Orta 6.5

• CVE-2026-92551kimlik doğrulamasız · tıklama gerekir≤ 4.17.4

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_bil

  Orta 6.1

• CVE-2024-1519kimlik doğrulamasız≤ 4.14.4

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.4 - Unauthenticated Stored Cross-S

  Orta 6.1

• CVE-2023-23830kimlik doğrulamasız · tıklama gerekir≤ 4.5.4

  WordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS)

  Orta 6.1

• CVE-2022-47444kimlik doğrulamasız · tıklama gerekir≤ 4.5.3

  WordPress ProfilePress Plugin <= 4.4.1 is vulnerable to Cross Site Scripting (XSS)

  Orta 6.1

• CVE-2026-18385abone+≤ 4.16.19

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortc

  Orta 5.4

• CVE-2025-13642abone+≤ 4.16.7

  ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

  Orta 5.4

• CVE-2024-2861katılımcı+≤ 4.15.8

  ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget

  Orta 5.4

• CVE-2024-2867katılımcı+≤ 4.15.4

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.4 - Authenticated (Contributor+) S

  Orta 5.4

• CVE-2024-3210katılımcı+≤ 4.15.5

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.5 - Authenticated (Contributor+) S

  Orta 5.4

• CVE-2024-1806katılımcı+≤ 4.15.1

  ProfilePress <= 4.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode

  Orta 5.4

• CVE-2024-1535katılımcı+≤ 4.15.2

  ProfilePress <= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

  Orta 5.4

• CVE-2024-1409katılımcı+≤ 4.15.0

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.0 - Authenticated (Contributor+) S

  Orta 5.4

• CVE-2024-1570katılımcı+≤ 4.14.4

  ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

  Orta 5.4

• CVE-2024-1408katılımcı+≤ 4.14.4

  ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcode

  Orta 5.4

• CVE-2024-1046katılımcı+≤ 4.14.3

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.3 - Authenticated (Contributor+) S

  Orta 5.4

• CVE-2023-23820katılımcı+≤ 4.5.4

  WordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS)

  Orta 5.4

• CVE-2023-41953kimlik doğrulamasız≤ 4.13.1

  WordPress ProfilePress plugin <= 4.13.1 - Broken Access Control vulnerability

  Orta 5.3

• CVE-2023-50882kimlik doğrulamasız≤ 4.13.2

  WordPress ProfilePress plugin <= 4.13.2 - Broken Access Control vulnerability

  Orta 5.3

• CVE-2024-11083kimlik doğrulamasız≤ 4.15.18

  ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure

  Orta 5.3

• CVE-2023-23996yönetici≤ 4.5.3

  WordPress ProfilePress Plugin <= 4.5.3 is vulnerable to Cross Site Scripting (XSS)

  Orta 4.8

• CVE-2022-4698yönetici≤ 4.5.0

  ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form Settings

  Orta 4.8

• CVE-2022-4697yönetici≤ 4.5.0

  ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

  Orta 4.8

• CVE-2026-4949abone+≤ 4.16.12

  ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription

  Orta 4.3