Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

Güvenlik açıkları

• CVE-2026-66047→ 4.17.2

  ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE

  Kritik 9.2

• CVE-2026-13352

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File

  Yüksek 8.8

• CVE-2023-41954

  WordPress ProfilePress plugin <= 4.13.1 - Unauthenticated Limited Privilege Escalation vulnerability

  Yüksek 8.6

• CVE-2026-85658

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortco

  Yüksek 8.1

• CVE-2026-3453

  ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration

  Yüksek 8.1

• CVE-2023-44150

  WordPress ProfilePress Plugin <= 4.13.2 is vulnerable to Sensitive Data Exposure

  Yüksek 7.5

• CVE-2022-45083

  WordPress ProfilePress Plugin <= 4.3.2 is vulnerable to PHP Object Injection

  Yüksek 7.2

• CVE-2026-3445

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Missing Authorization to Auth

  Yüksek 7.1

• CVE-2026-41556

  WordPress ProfilePress plugin <= 4.16.13 - Cross Site Scripting (XSS) vulnerability

  Orta 6.5

• CVE-2026-3309

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Sho

  Orta 6.5

• CVE-2025-8878

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Sho

  Orta 6.5

• CVE-2024-1519

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.4 - Unauthenticated Stored Cross-S

  Orta 6.1

• CVE-2023-23830

  WordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS)

  Orta 6.1

• CVE-2022-47444

  WordPress ProfilePress Plugin <= 4.4.1 is vulnerable to Cross Site Scripting (XSS)

  Orta 6.1

• CVE-2026-18385

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortc

  Orta 5.4

• CVE-2025-13642

  ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

  Orta 5.4

• CVE-2024-2861

  ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget

  Orta 5.4

• CVE-2024-2867

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.4 - Authenticated (Contributor+) S

  Orta 5.4

• CVE-2024-3210

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.5 - Authenticated (Contributor+) S

  Orta 5.4

• CVE-2024-1806

  ProfilePress <= 4.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode

  Orta 5.4

• CVE-2024-1535

  ProfilePress <= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

  Orta 5.4

• CVE-2024-1409

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.0 - Authenticated (Contributor+) S

  Orta 5.4

• CVE-2024-1570

  ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

  Orta 5.4

• CVE-2024-1408

  ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcode

  Orta 5.4

• CVE-2024-1046

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.3 - Authenticated (Contributor+) S

  Orta 5.4

• CVE-2023-23820

  WordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS)

  Orta 5.4

• CVE-2023-41953

  WordPress ProfilePress plugin <= 4.13.1 - Broken Access Control vulnerability

  Orta 5.3

• CVE-2023-50882

  WordPress ProfilePress plugin <= 4.13.2 - Broken Access Control vulnerability

  Orta 5.3

• CVE-2024-11083

  ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure

  Orta 5.3

• CVE-2023-23996

  WordPress ProfilePress Plugin <= 4.5.3 is vulnerable to Cross Site Scripting (XSS)

  Orta 4.8

• CVE-2022-4698

  ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form Settings

  Orta 4.8

• CVE-2022-4697

  ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

  Orta 4.8

• CVE-2026-4949

  ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription

  Orta 4.3