PatchTheCVE: profilepress

CVE-2024-13121: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content Wo

Wed, 17 Jun 2026 07:01:14 +0000

LOW 3.5: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when

CVE-2024-13120: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content Wo

Wed, 17 Jun 2026 07:01:14 +0000

MEDIUM 4.8: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when

CVE-2024-13119: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content Wo

Wed, 17 Jun 2026 07:01:14 +0000

CVE-2024-10518: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content Wo

Wed, 17 Jun 2026 06:55:50 +0000

MEDIUM 4.8: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Membership Plan settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting a

CVE-2024-10517: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content Wo

Wed, 17 Jun 2026 06:55:50 +0000

MEDIUM 4.8: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Drag & Drop Builder fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting

CVE-2023-41953: Missing Authorization vulnerability in ProfilePress Membership Team ProfilePress.This issue affects ProfilePre

Wed, 17 Jun 2026 06:23:08 +0000

MEDIUM 5.3: Missing Authorization vulnerability in ProfilePress Membership Team ProfilePress.This issue affects ProfilePress: from n/a through 4.13.1.

CVE-2023-50882: Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectl

Wed, 17 Jun 2026 06:40:09 +0000

MEDIUM 5.3: Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through <= 4.13.2.

CVE-2024-11083: The ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, a

Wed, 17 Jun 2026 06:57:01 +0000

MEDIUM 5.3: The ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.15.18 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-lev

CVE-2024-9947: The ProfilePress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and in

Wed, 17 Jun 2026 08:25:33 +0000

HIGH 8.1: The ProfilePress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.11.1. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing