PR
Product
ProfilePress
37
CVEs
0
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 4High 4Medium 28Low 1
Watch
Add ProfilePress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-96337 | 6.5 | Oct 9 | WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability Affected: through 4.17.3 |
| CVE-2026-41556 | 6.5 | Jun 15 | WordPress ProfilePress plugin <= 4.16.13 - Cross Site Scripting (XSS) vulnerability Affected: through 4.16.13 |
| CVE-2024-1519 | 6.1 | Feb 29 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site… Affected: before 4.15.0 |
| CVE-2023-23830 | 6.1 | May 3 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.4 versions Affected: before 4.5.5 |
| CVE-2022-47444 | 6.1 | Mar 29 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile &… Affected: through 4.5.3 |
| CVE-2021-24522 | 6.1 | Aug 9 | The User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for tabbed login/register was not properly… Affected: before 3.1.11 |
| CVE-2026-96518 | 5.9 | Oct 9 | WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability Affected: through 4.17.3 |
| CVE-2024-2861 | 5.4 | May 23 | ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget Affected: before 4.15.9 |
| CVE-2024-2867 | 5.4 | May 2 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site… Affected: before 4.15.5 |
| CVE-2024-3210 | 5.4 | Apr 10 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site… Affected: before 4.15.6 |
| CVE-2024-1806 | 5.4 | Mar 13 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site… Affected: before 4.15.2 |
| CVE-2024-1535 | 5.4 | Mar 13 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site… Affected: before 4.15.3 |
| CVE-2024-1409 | 5.4 | Mar 13 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site… Affected: before 4.15.1 |
| CVE-2024-1570 | 5.4 | Feb 29 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site… Affected: before 4.15.0 |
| CVE-2024-1408 | 5.4 | Feb 29 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site… Affected: before 4.15.0 |
| CVE-2024-1046 | 5.4 | Feb 5 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site… Affected: through 4.14.3 |
| CVE-2023-23820 | 5.4 | May 3 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.4 versions Affected: before 4.5.5 |
| CVE-2023-41953 | 5.3 | Dec 9 | WordPress ProfilePress plugin <= 4.13.1 - Broken Access Control vulnerability Affected: before 4.13.2 |
| CVE-2023-50882 | 5.3 | Dec 9 | WordPress ProfilePress plugin <= 4.13.2 - Broken Access Control vulnerability Affected: through 4.13.2 |
| CVE-2024-11083 | 5.3 | Nov 27 | ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure Affected: before 4.15.19 |
| CVE-2024-13120 | 4.8 | Feb 13 | ProfilePress < 4.15.20 - Admin+ Stored XSS Affected: before 4.15.20 |
| CVE-2024-13119 | 4.8 | Feb 13 | ProfilePress < 4.15.20 - Admin+ Stored XSS Affected: before 4.15.20 |
| CVE-2024-10518 | 4.8 | Dec 12 | ProfilePress < 4.15.15 - Admin+ Stored XSS Affected: before 4.15.15 |
| CVE-2024-10517 | 4.8 | Dec 12 | ProfilePress < 4.15.15 - Admin+ Stored XSS Affected: before 4.15.5 |
| CVE-2023-23996 | 4.8 | Apr 6 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.3 versions Affected: before 4.5.4 |
| CVE-2022-4698 | 4.8 | Dec 23 | The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several form fields in versions up to, and including, 4.5.0 due to insufficient input… Affected: before 4.5.1 |
| CVE-2022-4697 | 4.8 | Dec 23 | The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_user_cover_default_image_url’ parameter in versions up to, and including, 4.5.0 due… Affected: before 4.5.1 |
| CVE-2021-24450 | 4.8 | Aug 2 | The User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sanitise or escape some of its settings… Affected: before 3.1.8 |
Showing 28