PM
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
14
CVEs
0
On KEV
8.8
Max CVSS
3
New 30D
Severity mix
Critical 0High 5Medium 9Low 0
Watch
Add Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-92536 | 8.8 | Oct 3 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields Affected: through 4.17.4 |
| CVE-2026-13352 | 8.8 | Jul 17 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion Affected: through 4.16.18 |
| CVE-2026-85658 | 8.1 | Sep 19 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket) Affected: through 4.17.2 |
| CVE-2026-3453 | 8.1 | Mar 11 | ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration Affected: through 4.16.11 |
| CVE-2026-3445 | 7.1 | Apr 4 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass Affected: through 4.16.11 |
| CVE-2026-3309 | 6.5 | Apr 4 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields Affected: through 4.16.11 |
| CVE-2025-8878 | 6.5 | Aug 16 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution Affected: through 4.16.4 |
| CVE-2026-92551 | 6.1 | Oct 3 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter Affected: through 4.17.4 |
| CVE-2026-104003 | 5.4 | Oct 16 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab Affected: through 4.17.5 |
| CVE-2026-18385 | 5.4 | Aug 16 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field Affected: through 4.16.19 |
| CVE-2025-13642 | 5.4 | Dec 9 | ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution Affected: through 4.16.7 |
| CVE-2024-2861 | 5.4 | May 23 | ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget Affected: through 4.15.8 |
| CVE-2024-11083 | 5.3 | Nov 27 | ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure Affected: through 4.15.18 |
| CVE-2026-4949 | 4.3 | Apr 15 | ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription Affected: through 4.16.12 |
Showing 14