PR
Product
ProfilePress
37
CVEs
0
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 4High 4Medium 28Low 1
Watch
Add ProfilePress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-9947 | 9.8 | Oct 23 | ProfilePress - Pro <= 4.11.1 - Authentication Bypass via WordPress.com OAuth provider Affected: before 4.11.2 |
| CVE-2021-34624 | 9.8 | Jul 7 | A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary… Affected: 3.0.0 through 3.1.3 |
| CVE-2021-34623 | 9.8 | Jul 7 | A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload… Affected: 3.0.0 through 3.1.3 |
| CVE-2021-34621 | 9.8 | Jul 7 | A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register… Affected: 3.0.0 through 3.1.3 |
| CVE-2021-34622 | 8.8 | Jul 7 | A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible for users to… Affected: 3.0.0 through 3.1.3 |
| CVE-2023-41954 | 8.6 | May 17 | Improper Privilege Management vulnerability in ProfilePress Membership Team ProfilePress allows Privilege Escalation.This issue affects ProfilePress: from n/a through 4.13.1 Affected: before 4.13.2 |
| CVE-2023-44150 | 7.5 | Nov 30 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User… Affected: before 4.13.3 |
| CVE-2022-45083 | 7.2 | Jan 19 | Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict… Affected: before 4.4.0 |
| CVE-2026-96337 | 6.5 | Oct 9 | WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability Affected: through 4.17.3 |
| CVE-2026-41556 | 6.5 | Jun 15 | WordPress ProfilePress plugin <= 4.16.13 - Cross Site Scripting (XSS) vulnerability Affected: through 4.16.13 |
| CVE-2024-1519 | 6.1 | Feb 29 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site… Affected: before 4.15.0 |
| CVE-2023-23830 | 6.1 | May 3 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.4 versions Affected: before 4.5.5 |
| CVE-2022-47444 | 6.1 | Mar 29 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile &… Affected: through 4.5.3 |
| CVE-2021-24522 | 6.1 | Aug 9 | The User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for tabbed login/register was not properly… Affected: before 3.1.11 |
| CVE-2026-96518 | 5.9 | Oct 9 | WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability Affected: through 4.17.3 |
| CVE-2024-2861 | 5.4 | May 23 | The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ProfilePress User Panel widget in all versions up to, and including, 4.15.8 due to… Affected: before 4.15.9 |
| CVE-2024-2867 | 5.4 | May 2 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site… Affected: before 4.15.5 |
| CVE-2024-3210 | 5.4 | Apr 10 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site… Affected: before 4.15.6 |
| CVE-2024-1806 | 5.4 | Mar 13 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site… Affected: before 4.15.2 |
| CVE-2024-1535 | 5.4 | Mar 13 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site… Affected: before 4.15.3 |
| CVE-2024-1409 | 5.4 | Mar 13 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site… Affected: before 4.15.1 |
| CVE-2024-1570 | 5.4 | Feb 29 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site… Affected: before 4.15.0 |
| CVE-2024-1408 | 5.4 | Feb 29 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site… Affected: before 4.15.0 |
| CVE-2024-1046 | 5.4 | Feb 5 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site… Affected: through 4.14.3 |
| CVE-2023-23820 | 5.4 | May 3 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.4 versions Affected: before 4.5.5 |
| CVE-2023-41953 | 5.3 | Dec 9 | WordPress ProfilePress plugin <= 4.13.1 - Broken Access Control vulnerability Affected: before 4.13.2 |
| CVE-2023-50882 | 5.3 | Dec 9 | WordPress ProfilePress plugin <= 4.13.2 - Broken Access Control vulnerability Affected: through 4.13.2 |
| CVE-2024-11083 | 5.3 | Nov 27 | ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure Affected: before 4.15.19 |
| CVE-2024-13120 | 4.8 | Feb 13 | ProfilePress < 4.15.20 - Admin+ Stored XSS Affected: before 4.15.20 |
| CVE-2024-13119 | 4.8 | Feb 13 | ProfilePress < 4.15.20 - Admin+ Stored XSS Affected: before 4.15.20 |
| CVE-2024-10518 | 4.8 | Dec 12 | ProfilePress < 4.15.15 - Admin+ Stored XSS Affected: before 4.15.15 |
| CVE-2024-10517 | 4.8 | Dec 12 | ProfilePress < 4.15.15 - Admin+ Stored XSS Affected: before 4.15.5 |
| CVE-2023-23996 | 4.8 | Apr 6 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.3 versions Affected: before 4.5.4 |
| CVE-2022-4698 | 4.8 | Dec 23 | The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several form fields in versions up to, and including, 4.5.0 due to insufficient input… Affected: before 4.5.1 |
| CVE-2022-4697 | 4.8 | Dec 23 | The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_user_cover_default_image_url’ parameter in versions up to, and including, 4.5.0 due… Affected: before 4.5.1 |
| CVE-2021-24450 | 4.8 | Aug 2 | The User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sanitise or escape some of its settings… Affected: before 3.1.8 |
| CVE-2024-13121 | 3.5 | Feb 13 | Paid Membership Plugin < 4.15.20 - Admin+ Stored XSS Affected: before 4.15.20 |
Showing 37