Cross-Site Scripting
28 records62.2%First: 2021. Latest: 2026.
Plugin security history
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 45 vulnerability records associated with Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress, published between 2021 and 2026.
Dataset last synchronized: 2026-08-02 09:41:47 UTC
At a glance
Security Snapshot
45Total records
5Critical
7High
33Medium
0Low
0Informational
45Patched records
0Currently marked unpatched
2021-06-28First disclosure
2026-07-16Latest disclosure
43 of 45CVE coverage
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2021 | 8 | |
| 2022 | 4 | |
| 2023 | 8 | |
| 2024 | 13 | |
| 2025 | 5 | |
| 2026 | 7 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| Critical | 5 | 11.1% |
| High | 7 | 15.6% |
| Medium | 33 | 73.3% |
Vulnerability-Type Breakdown
Privilege Escalation
4 records8.9%First: 2021. Latest: 2026.
Other
4 records8.9%First: 2022. Latest: 2026.
Arbitrary File Upload
3 records6.7%First: 2021. Latest: 2026.
Missing Authorization
3 records6.7%First: 2026. Latest: 2026.
Information Disclosure
2 records4.4%First: 2023. Latest: 2024.
CSRF
1 record2.2%First: 2023. Latest: 2023.
Patch Status
- Patched
- 45
- Currently marked unpatched
- 0
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
4.16.194.16.184.16.144.16.134.16.124.16.84.16.54.15.204.15.194.15.154.15.94.15.54.15.64.15.34.15.24.15.14.15.04.14.44.13.34.13.24.11.04.5.54.5.44.5.14.4.03.2.163.2.33.1.113.1.43.1.8
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-4.16.18 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion | July 16, 2026 | 4.16.19 | High |
*-4.16.17 | ProfilePress <= 4.16.17 - Unauthenticated Privilege Escalation | July 3, 2026 | 4.16.18 | Critical |
*-4.16.13 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting | April 23, 2026 | 4.16.14 | Medium |
*-4.16.12 | ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription | April 15, 2026 | 4.16.13 | Medium |
*-4.16.11 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields | April 3, 2026 | 4.16.12 | Medium |
*-4.16.11 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass | April 3, 2026 | 4.16.12 | High |
*-4.16.11 | ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration | March 10, 2026 | 4.16.12 | High |
*-4.16.7 | ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution | December 8, 2025 | 4.16.8 | Medium |
*-4.16.4 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution | August 15, 2025 | 4.16.5 | Medium |
*-4.15.19 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting | January 23, 2025 | 4.15.20 | Medium |
*-4.15.19 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting | January 23, 2025 | 4.15.20 | Medium |
*-4.15.19 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting | January 23, 2025 | 4.15.20 | Medium |
*-4.15.18 | ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure | November 26, 2024 | 4.15.19 | Medium |
*-4.15.14 | ProfilePress <= 4.15.14 - Authenticated (Admin+) Stored Cross-Site Scripting via "Product Files" | November 21, 2024 | 4.15.15 | Medium |
*-4.15.14 | ProfilePress <= 4.15.14 - Authenticated (Admin+) Stored Cross-Site Scripting via "Labels" | November 21, 2024 | 4.15.15 | Medium |
*-4.15.8 | ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget | May 22, 2024 | 4.15.9 | Medium |
*-4.15.4 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.4 - Authenticated (Contributor+) Stored Cross-Site Scripting | April 11, 2024 | 4.15.5 | Medium |
*-4.15.5 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'reg-single-checkbox' | April 9, 2024 | 4.15.6 | Medium |
*-4.15.2 | ProfilePress <= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode | March 12, 2024 | 4.15.3 | Medium |
*-4.15.1 | ProfilePress <= 4.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode | February 23, 2024 | 4.15.2 | Medium |
*-4.15.0 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via [reg-select-role] Shortcode | February 22, 2024 | 4.15.1 | Medium |
*-4.14.4 | ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcode | February 19, 2024 | 4.15.0 | Medium |
*-4.14.4 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.4 - Unauthenticated Stored Cross-Site Scripting | February 19, 2024 | 4.15.0 | Medium |
*-4.14.4 | ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode | February 19, 2024 | 4.15.0 | Medium |
*-4.14.3 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting | February 1, 2024 | 4.14.4 | Medium |
Selected source records
Latest Records
HighCVE-2026-13352
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion
Published: July 16, 2026
- Affected versions
- *-4.16.18
- Patched versions
- 4.16.19
CriticalCVE-2026-12497
ProfilePress <= 4.16.17 - Unauthenticated Privilege Escalation
Published: July 3, 2026
- Affected versions
- *-4.16.17
- Patched versions
- 4.16.18
MediumCVE-2026-41556
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Published: April 23, 2026
- Affected versions
- *-4.16.13
- Patched versions
- 4.16.14
MediumCVE-2026-4949
ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription
Published: April 15, 2026
- Affected versions
- *-4.16.12
- Patched versions
- 4.16.13
MediumCVE-2026-3309
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields
Published: April 3, 2026
- Affected versions
- *-4.16.11
- Patched versions
- 4.16.12
HighCVE-2026-3445
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass
Published: April 3, 2026
- Affected versions
- *-4.16.11
- Patched versions
- 4.16.12
HighCVE-2026-3453
ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration
Published: March 10, 2026
- Affected versions
- *-4.16.11
- Patched versions
- 4.16.12
MediumCVE-2025-13642
ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
Published: December 8, 2025
- Affected versions
- *-4.16.7
- Patched versions
- 4.16.8
Highest-Severity Records
CriticalCVE-2021-34623
User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation
Published: June 28, 2021
- Affected versions
- 3.0.0-3.1.3
- Patched versions
- 3.1.4
CriticalCVE-2021-34624
ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload
Published: June 28, 2021
- Affected versions
- 3.0.0-3.1.3
- Patched versions
- 3.1.4
CriticalCVE-2021-34621
User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation
Published: June 28, 2021
- Affected versions
- 3.0.0-3.1.3
- Patched versions
- 3.1.4
CriticalCVE-2021-34622
ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation
Published: June 28, 2021
- Affected versions
- 3.0.0-3.1.3
- Patched versions
- 3.1.4
CriticalCVE-2026-12497
ProfilePress <= 4.16.17 - Unauthenticated Privilege Escalation
Published: July 3, 2026
- Affected versions
- *-4.16.17
- Patched versions
- 4.16.18
HighCVE-2026-13352
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion
Published: July 16, 2026
- Affected versions
- *-4.16.18
- Patched versions
- 4.16.19
HighCVE-2026-3453
ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration
Published: March 10, 2026
- Affected versions
- *-4.16.11
- Patched versions
- 4.16.12
HighCVE-2023-41954
ProfilePress <= 4.13.1 - Limited Privilege Escalation via 'acceptable_defined_roles'
Published: September 9, 2023
- Affected versions
- [*, 4.13.2)
- Patched versions
- 4.13.2
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.