EN ES
Start free
Menu

ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content: known security problems

55 known security problems reported for this WordPress plugin, with the affected versions, the fix and what to do.

Updated

In short

There are 55 known security problems on this page. Each one has a fixed version. Updating to version 4.17.6 or newer covers every fixed problem listed here.

Based on public reports. Check the plugin’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 4.17.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.17.5
Fixed in
4.17.6
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.17.6 or newer.
Official ID
CVE-2026-104003
Report title
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.17.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.17.4
Fixed in
4.17.5
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.17.5 or newer.
Official ID
CVE-2026-92551
Report title
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter
First reported
Sources
This week

Anyone with an account on your site, even a basic one could run their own code on your site and take it over

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.17.4
Fixed in
4.17.5
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.17.5 or newer.
Official ID
CVE-2026-92536
Report title
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 4.17.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.17.3
Fixed in
4.17.4
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.17.4 or newer.
Official ID
CVE-2026-96337
Report title
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.17.3 - Missing Authorization
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 4.17.3) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.17.3
Fixed in
4.17.4
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.17.4 or newer.
Official ID
CVE-2026-96518
Report title
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.17.3 - Missing Authorization
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 4.17.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.17.2
Fixed in
4.17.3
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.17.3 or newer.
Official ID
CVE-2026-85658
Report title
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 4.17.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.17.1
Fixed in
4.17.2
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.17.2 or newer.
Official ID
CVE-2026-66047
Report title
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.17.1 - Unauthenticated Arbitrary Plugin Installation via Brute Force
First reported
Sources
This week

A stranger could use it to harm your site (before 4.17.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.17.1
Fixed in
4.17.1
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.17.1 or newer.
Official ID
CVE-2026-19848
Report title
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 4.16.19)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.16.19
Fixed in
4.17.0
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.17.0 or newer.
Official ID
CVE-2026-18385
Report title
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field
First reported
Sources
This week

Someone with an author account on your site could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.16.18
Fixed in
4.16.19
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.16.19 or newer.
Official ID
CVE-2026-13352
Report title
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion
First reported
Sources
This week

A stranger could take over your site as an admin (up to and including 4.16.17)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.16.17
Fixed in
4.16.18
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.16.18 or newer.
Official ID
CVE-2026-12497
Report title
ProfilePress <= 4.16.17 - Unauthenticated Privilege Escalation
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 4.16.16)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.16.16
Fixed in
4.16.17
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.16.17 or newer.
Official ID
CVE-2026-10820
Report title
ProfilePress <= 4.16.16 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.16.13
Fixed in
4.16.14
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.16.14 or newer.
Official ID
CVE-2026-41556
Report title
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting
First reported
Sources
This week

Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to (up to and including 4.16.12)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.16.12
Fixed in
4.16.13
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.16.13 or newer.
Official ID
CVE-2026-4949
Report title
ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 4.16.11)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.16.11
Fixed in
4.16.12
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.16.12 or newer.
Official ID
CVE-2026-3309
Report title
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields
First reported
Sources
This week

Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to (up to and including 4.16.11)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.16.11
Fixed in
4.16.12
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.16.12 or newer.
Official ID
CVE-2026-3445
Report title
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 4.16.11)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.16.11
Fixed in
4.16.12
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.16.12 or newer.
Official ID
CVE-2026-3453
Report title
ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 4.16.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.16.7
Fixed in
4.16.8
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.16.8 or newer.
Official ID
CVE-2025-13642
Report title
ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 4.16.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.16.4
Fixed in
4.16.5
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.16.5 or newer.
Official ID
CVE-2025-8878
Report title
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.15.19)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.15.19
Fixed in
4.15.20
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.15.20 or newer.
Official ID
CVE-2024-13120
Report title
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.15.19) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.15.19
Fixed in
4.15.20
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.15.20 or newer.
Official ID
CVE-2024-13121
Report title
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.15.19) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.15.19
Fixed in
4.15.20
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.15.20 or newer.
Official ID
CVE-2024-13119
Report title
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could see private information they should not see

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.15.18
Fixed in
4.15.19
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.15.19 or newer.
Official ID
CVE-2024-11083
Report title
ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.15.14)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.15.14
Fixed in
4.15.15
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.15.15 or newer.
Official ID
CVE-2024-10517
Report title
ProfilePress <= 4.15.14 - Authenticated (Admin+) Stored Cross-Site Scripting via "Labels"
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.15.14) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.15.14
Fixed in
4.15.15
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.15.15 or newer.
Official ID
CVE-2024-10518
Report title
ProfilePress <= 4.15.14 - Authenticated (Admin+) Stored Cross-Site Scripting via "Product Files"
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 4.15.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.15.8
Fixed in
4.15.9
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.15.9 or newer.
Official ID
CVE-2024-2861
Report title
ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 4.15.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.15.4
Fixed in
4.15.5
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.15.5 or newer.
Official ID
CVE-2024-2867
Report title
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 4.15.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.15.5
Fixed in
4.15.6
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.15.6 or newer.
Official ID
CVE-2024-3210
Report title
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'reg-single-checkbox'
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 4.15.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.15.2
Fixed in
4.15.3
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.15.3 or newer.
Official ID
CVE-2024-1535
Report title
ProfilePress <= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 4.15.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.15.1
Fixed in
4.15.2
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.15.2 or newer.
Official ID
CVE-2024-1806
Report title
ProfilePress <= 4.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 4.15.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.15.0
Fixed in
4.15.1
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.15.1 or newer.
Official ID
CVE-2024-1409
Report title
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via [reg-select-role] Shortcode
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 4.14.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.14.4
Fixed in
4.15.0
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.15.0 or newer.
Official ID
CVE-2024-1570
Report title
ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 4.14.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.14.4
Fixed in
4.15.0
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.15.0 or newer.
Official ID
CVE-2024-1519
Report title
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.4 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 4.14.4) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.14.4
Fixed in
4.15.0
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.15.0 or newer.
Official ID
CVE-2024-1408
Report title
ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcode
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 4.14.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.14.3
Fixed in
4.14.4
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.14.4 or newer.
Official ID
CVE-2024-1046
Report title
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.13.2
Fixed in
4.13.3
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.13.3 or newer.
Official ID
CVE-2023-44150
Report title
ProfilePress <= 4.13.2 - Information Disclosure via Debug Log
First reported
Sources
This week

Someone could take over your site as an admin

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.13.2
Fixed in
4.13.2
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.13.2 or newer.
Official ID
CVE-2023-41954
Report title
ProfilePress <= 4.13.1 - Limited Privilege Escalation via 'acceptable_defined_roles'
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.13.2
Fixed in
4.13.2
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.13.2 or newer.
Official ID
CVE-2023-41953
Report title
ProfilePress <= 4.13.1 Cross-Site Request Forgery via 'admin_notice'
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 4.11.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.11.0
Fixed in
4.11.0
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.11.0 or newer.
Report title
ProfilePress <= 4.10.3 - Reflected Cross-Site Scripting via error message
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 4.5.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.5.3
Fixed in
4.5.4
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.5.4 or newer.
Official ID
CVE-2022-47444
Report title
ProfilePress <= 4.5.3 - Unauthenticated Cross-Site Scripting
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 4.5.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.5.4
Fixed in
4.5.5
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.5.5 or newer.
Official ID
CVE-2023-23830
Report title
ProfilePress <= 4.5.4 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 4.5.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.5.4
Fixed in
4.5.5
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.5.5 or newer.
Official ID
CVE-2023-23820
Report title
ProfilePress <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
First reported
Sources
This week

Someone who already has an admin account could plant harmful code that runs for your visitors or admins (up to and including 4.5.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.5.3
Fixed in
4.5.4
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.5.4 or newer.
Official ID
CVE-2023-23996
Report title
ProfilePress <= 4.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone who already has an admin account could plant harmful code that runs for your visitors or admins (up to and including 4.5.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.5.0
Fixed in
4.5.1
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.5.1 or newer.
Official ID
CVE-2022-4697
Report title
ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone who already has an admin account could plant harmful code that runs for your visitors or admins (up to and including 4.5.0) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.5.0
Fixed in
4.5.1
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.5.1 or newer.
Official ID
CVE-2022-4698
Report title
ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form Settings
First reported
Sources
This week

Someone could in some setups, take over your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.3.2
Fixed in
4.4.0
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 4.4.0 or newer.
Official ID
CVE-2022-45083
Report title
ProfilePress <= 4.3.2 - Authenticated (Admin+) PHP Object Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.2.15)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.15
Fixed in
3.2.16
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 3.2.16 or newer.
Report title
WordPress Membership, User Registration, Login Form, User Profile & Restrict Content Plugin – ProfilePress <= 3.2.15 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 3.2.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.2.3
Fixed in
3.2.3
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 3.2.3 or newer.
Official ID
CVE-2021-24955
Report title
ProfilePress <= 3.2.2 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 3.2.3) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.2.3
Fixed in
3.2.3
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 3.2.3 or newer.
Official ID
CVE-2021-24954
Report title
ProfilePress <= 3.2.2 - Reflected Cross-Site Scripting via ppress_cc_data Parameter
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 3.1.10)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.1.10
Fixed in
3.1.11
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 3.1.11 or newer.
Official ID
CVE-2021-24522
Report title
Paid Membership, User Registration, User Profile & Restrict Content Plugin – ProfilePress <= 3.1.10 - Unauthenticated Cross-Site Scripting
First reported
Sources
This week

Someone could run their own code on your site and take it over

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 3.0.0 up to and including 3.1.3
Fixed in
3.1.4
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 3.1.4 or newer.
Official ID
CVE-2021-34624
Report title
ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload
First reported
Sources
This week

A stranger could take over your site as an admin (from 3.0.0 up to and including 3.1.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 3.0.0 up to and including 3.1.3
Fixed in
3.1.4
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 3.1.4 or newer.
Official ID
CVE-2021-34622
Report title
ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 3.1.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.1.8
Fixed in
3.1.8
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 3.1.8 or newer.
Official ID
CVE-2021-24450
Report title
ProfilePress <= 3.1.7 - Authenticated Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could take over your site as an admin (from 3.0.0 up to and including 3.1.3) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 3.0.0 up to and including 3.1.3
Fixed in
3.1.4
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 3.1.4 or newer.
Official ID
CVE-2021-34623
Report title
User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation
First reported
Sources
This week

A stranger could take over your site as an admin (from 3.0.0 up to and including 3.1.3) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 3.0.0 up to and including 3.1.3
Fixed in
3.1.4
What to do
If your site has an affected version, update ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content to version 3.1.4 or newer.
Official ID
CVE-2021-34621
Report title
User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation
First reported
Sources

Where this comes from

We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)