Login Request a demo
PR
Vendor
properfraction
8 products with CVEs on record
60
CVEs
0
On KEV
6
New 30D
Products
PR
ProfilePress
properfraction
9.8
37 CVEs0 on KEV2 new
PM
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
properfraction
8.8
13 CVEs0 on KEV3 new
MP
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.
properfraction
9.8
2 CVEs0 on KEV1 new
MA
MailOptin
properfraction
9.8
3 CVEs0 on KEV0 new
KS
kk Star Ratings – Rate Post & Collect User Feedbacks
properfraction
7.3
2 CVEs0 on KEV0 new
AB
Admin Bar & Dashboard Access Control
Properfraction
4.8
1 CVEs0 on KEV0 new
CS
CrawlWP SEO
properfraction
4.3
1 CVEs0 on KEV0 new
RM
Rate My Post – Star Rating Plugin by FeedbackWP
properfraction
5.3
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-104003
PM
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
properfraction
5.4
0%
Oct 16Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab
CVE-2026-109515
MP
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.
properfraction
9.8
0%
Oct 16MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter
CVE-2026-96337
PR
ProfilePress
properfraction
6.5
0%
Oct 9WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability
CVE-2026-96518
PR
ProfilePress
properfraction
5.9
0%
Oct 9WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability
CVE-2026-92551
PM
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
properfraction
6.1
0%
Oct 3Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter
CVE-2026-92536
PM
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
properfraction
8.8
1%
Oct 3Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields
CVE-2026-85658
PM
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
properfraction
8.1
1%
Sep 19Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)
CVE-2026-3424
KS
kk Star Ratings – Rate Post & Collect User Feedbacks
properfraction
5.3
1%
Aug 22kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter
CVE-2026-18385
PM
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
properfraction
5.4
1%
Aug 16Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field
CVE-2026-66703
MA
MailOptin
properfraction
6.5
0%
Aug 6WordPress MailOptin plugin <= 1.2.78.0 - Cross Site Scripting (XSS) vulnerability
CVE-2026-13352
PM
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
properfraction
8.8
1%
Jul 17Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion
CVE-2026-57813
MA
MailOptin
properfraction
9.8
0%
Jul 13WordPress MailOptin plugin <= 1.2.77.3 - Privilege Escalation vulnerability
CVE-2026-59520
CS
CrawlWP SEO
properfraction
4.3
0%
Jul 5WordPress CrawlWP SEO plugin <= 3.0.16 - Cross Site Request Forgery (CSRF) vulnerability
CVE-2026-41556
PR
ProfilePress
properfraction
6.5
0%
Jun 15WordPress ProfilePress plugin <= 4.16.13 - Cross Site Scripting (XSS) vulnerability
CVE-2026-4949
PM
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
properfraction
4.3
0%
Apr 15ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription
CVE-2026-3309
PM
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
properfraction
6.5
0%
Apr 4Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields
CVE-2026-3445
PM
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
properfraction
7.1
0%
Apr 4Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass
CVE-2026-3453
PM
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
properfraction
8.1
0%
Mar 11ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration
CVE-2025-13642
PM
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
properfraction
5.4
0%
Dec 9ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
CVE-2025-58596
MA
MailOptin
properfraction
5.9
0%
Sep 3WordPress MailOptin Plugin <= 1.2.75.0 - Cross Site Scripting (XSS) Vulnerability
CVE-2025-8878
PM
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
properfraction
6.5
0%
Aug 16Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution
CVE-2024-13121
PR
Profilepress
Properfraction
3.5
0%
Feb 13Paid Membership Plugin < 4.15.20 - Admin+ Stored XSS
CVE-2024-13120
PR
Profilepress
Properfraction
4.8
0%
Feb 13ProfilePress < 4.15.20 - Admin+ Stored XSS
CVE-2024-13119
PR
Profilepress
Properfraction
4.8
0%
Feb 13ProfilePress < 4.15.20 - Admin+ Stored XSS
CVE-2024-11977
KS
kk Star Ratings – Rate Post & Collect User Feedbacks
properfraction
7.3
1%
Dec 21kk Star Ratings – Rate Post & Collect User Feedbacks <= 5.4.10 - Unauthenticated Arbitrary Shortcode Execution
CVE-2024-12309
RM
Rate My Post – Star Rating Plugin by FeedbackWP
properfraction
5.3
0%
Dec 13Rate My Post – Star Rating Plugin by FeedbackWP <= 4.2.4 - Unauthenticated Voting On Scheduled Posts
CVE-2024-10518
PR
Profilepress
Properfraction
4.8
0%
Dec 12ProfilePress < 4.15.15 - Admin+ Stored XSS
CVE-2024-10517
PR
Profilepress
Properfraction
4.8
0%
Dec 12ProfilePress < 4.15.15 - Admin+ Stored XSS
CVE-2023-41953
PR
Profilepress
Properfraction
5.3
0%
Dec 9WordPress ProfilePress plugin <= 4.13.1 - Broken Access Control vulnerability
CVE-2023-50882
PR
ProfilePress
properfraction
5.3
1%
Dec 9WordPress ProfilePress plugin <= 4.13.2 - Broken Access Control vulnerability
CVE-2024-11083
PM
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
properfraction
5.3
0%
Nov 27ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
CVE-2024-9947
PR
Profilepress
Properfraction
9.8
1%
Oct 23ProfilePress - Pro <= 4.11.1 - Authentication Bypass via WordPress.com OAuth provider
CVE-2024-8628
MP
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.
properfraction
5.4
0%
Sep 24Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin <= 1.2.70.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
CVE-2024-2861
PR
Profilepress
Properfraction
5.4
0%
May 23The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ProfilePress User Panel widget in all versions up to, and including, 4.15.8 due to…
CVE-2023-41954
PR
Profilepress
Properfraction
8.6
1%
May 17Improper Privilege Management vulnerability in ProfilePress Membership Team ProfilePress allows Privilege Escalation.This issue affects ProfilePress: from n/a through 4.13.1
CVE-2024-2867
PR
Profilepress
Properfraction
5.4
0%
May 2The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site…
CVE-2024-3210
PR
Profilepress
Properfraction
5.4
0%
Apr 10The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site…
CVE-2024-1806
PR
Profilepress
Properfraction
5.4
1%
Mar 13The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site…
CVE-2024-1535
PR
Profilepress
Properfraction
5.4
1%
Mar 13The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site…
CVE-2024-1409
PR
Profilepress
Properfraction
5.4
0%
Mar 13The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site…
CVE-2024-1570
PR
Profilepress
Properfraction
5.4
0%
Feb 29The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site…
CVE-2024-1519
PR
Profilepress
Properfraction
6.1
1%
Feb 29The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site…
CVE-2024-1408
PR
Profilepress
Properfraction
5.4
1%
Feb 29The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site…
CVE-2024-1046
PR
Profilepress
Properfraction
5.4
0%
Feb 5The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site…
CVE-2022-45083
PR
Profilepress
Properfraction
7.2
1%
Jan 19Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict…
CVE-2023-44150
PR
Profilepress
Properfraction
7.5
1%
Nov 30Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User…
CVE-2023-47184
AB
Admin Bar & Dashboard Access Control
Properfraction
4.8
0%
Nov 6Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Proper Fraction LLC. Admin Bar & Dashboard Access Control plugin <= 1.2.8 versions
CVE-2023-23830
PR
Profilepress
Properfraction
6.1
0%
May 3Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.4 versions
CVE-2023-23820
PR
Profilepress
Properfraction
5.4
0%
May 3Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.4 versions
CVE-2023-23996
PR
Profilepress
Properfraction
4.8
0%
Apr 6Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.3 versions
CVE-2022-47444
PR
Profilepress
Properfraction
6.1
0%
Mar 29Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile &…
CVE-2022-4698
PR
Profilepress
Properfraction
4.8
1%
Dec 23The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several form fields in versions up to, and including, 4.5.0 due to insufficient input…
CVE-2022-4697
PR
Profilepress
Properfraction
4.8
1%
Dec 23The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_user_cover_default_image_url’ parameter in versions up to, and including, 4.5.0 due…
CVE-2021-24522
PR
Profilepress
Properfraction
6.1
2%
Aug 9The User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for tabbed login/register was not properly…
CVE-2021-24450
PR
Profilepress
Properfraction
4.8
1%
Aug 2The User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sanitise or escape some of its settings…
CVE-2021-34624
PR
Profilepress
Properfraction
9.8
8%
Jul 7A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary…
CVE-2021-34623
PR
Profilepress
Properfraction
9.8
2%
Jul 7A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload…
CVE-2021-34622
PR
Profilepress
Properfraction
8.8
4%
Jul 7A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible for users to…
CVE-2021-34621
PR
Profilepress
Properfraction
9.8
69%
Jul 7A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register…