Plugin security history

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 45 vulnerability records associated with Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress, published between 2021 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

45Total records

5Critical

7High

33Medium

0Low

0Informational

45Patched records

0Currently marked unpatched

2021-06-28First disclosure

2026-07-16Latest disclosure

43 of 45CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2021	8	8 records
2022	4	4 records
2023	8	8 records
2024	13	13 records
2025	5	5 records
2026	7	7 records

Severity Breakdown

Severity	Records	Share
Critical	5	11.1%
High	7	15.6%
Medium	33	73.3%

Vulnerability-Type Breakdown

Cross-Site Scripting

28 records62.2%

First: 2021. Latest: 2026.

Privilege Escalation

4 records8.9%

First: 2021. Latest: 2026.

Other

4 records8.9%

First: 2022. Latest: 2026.

Arbitrary File Upload

3 records6.7%

First: 2021. Latest: 2026.

Missing Authorization

3 records6.7%

First: 2026. Latest: 2026.

Information Disclosure

2 records4.4%

First: 2023. Latest: 2024.

CSRF

1 record2.2%

First: 2023. Latest: 2023.

Patch Status

Patched: 45
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

4.16.19
4.16.18
4.16.14
4.16.13
4.16.12
4.16.8
4.16.5
4.15.20
4.15.19
4.15.15
4.15.9
4.15.5
4.15.6
4.15.3
4.15.2
4.15.1
4.15.0
4.14.4
4.13.3
4.13.2
4.11.0
4.5.5
4.5.4
4.5.1
4.4.0
3.2.16
3.2.3
3.1.11
3.1.4
3.1.8

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-4.13.2`	ProfilePress <= 4.13.2 - Information Disclosure via Debug Log	October 2, 2023	4.13.3	Medium
`[*, 4.13.2)`	ProfilePress <= 4.13.1 Cross-Site Request Forgery via 'admin_notice'	September 9, 2023	4.13.2	Medium
`[*, 4.13.2)`	ProfilePress <= 4.13.1 - Limited Privilege Escalation via 'acceptable_defined_roles'	September 9, 2023	4.13.2	High
`[*, 4.11.0)`	ProfilePress <= 4.10.3 - Reflected Cross-Site Scripting via error message	June 23, 2023	4.11.0	Medium
`*-4.5.3`	ProfilePress <= 4.5.3 - Unauthenticated Cross-Site Scripting	March 27, 2023	4.5.4	High
`*-4.5.4`	ProfilePress <= 4.5.4 - Unauthenticated Stored Cross-Site Scripting	February 21, 2023	4.5.5	High
`*-4.5.4`	ProfilePress <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes	February 20, 2023	4.5.5	Medium
`*-4.5.3`	ProfilePress <= 4.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting	January 20, 2023	4.5.4	Medium
`*-4.5.0`	ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form Settings	December 23, 2022	4.5.1	Medium
`*-4.5.0`	ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting	December 23, 2022	4.5.1	Medium
`*-4.3.2`	ProfilePress <= 4.3.2 - Authenticated (Admin+) PHP Object Injection	December 14, 2022	4.4.0	Medium
`*-3.2.15`	WordPress Membership, User Registration, Login Form, User Profile & Restrict Content Plugin – ProfilePress <= 3.2.15 - Reflected Cross-Site Scripting	July 22, 2022	3.2.16	Medium
`[*, 3.2.3)`	ProfilePress <= 3.2.2 - Reflected Cross-Site Scripting via ppress_cc_data Parameter	November 15, 2021	3.2.3	Medium
`[*, 3.2.3)`	ProfilePress <= 3.2.2 - Reflected Cross-Site Scripting	November 15, 2021	3.2.3	Medium
`*-3.1.10`	Paid Membership, User Registration, User Profile & Restrict Content Plugin – ProfilePress <= 3.1.10 - Unauthenticated Cross-Site Scripting	August 9, 2021	3.1.11	High
`3.0.0-3.1.3`	ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation	June 28, 2021	3.1.4	Critical
`3.0.0-3.1.3`	ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload	June 28, 2021	3.1.4	Critical
`3.0.0-3.1.3`	User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation	June 28, 2021	3.1.4	Critical
`3.0.0-3.1.3`	User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation	June 28, 2021	3.1.4	Critical
`[*, 3.1.8)`	ProfilePress <= 3.1.7 - Authenticated Stored Cross-Site Scripting	June 28, 2021	3.1.8	Medium

Selected source records

Latest Records

HighCVE-2026-13352

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion

Published: July 16, 2026

Affected versions: *-4.16.18
Patched versions: 4.16.19

Original Wordfence record

CriticalCVE-2026-12497

ProfilePress <= 4.16.17 - Unauthenticated Privilege Escalation

Published: July 3, 2026

Affected versions: *-4.16.17
Patched versions: 4.16.18

Original Wordfence record

MediumCVE-2026-41556

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Published: April 23, 2026

Affected versions: *-4.16.13
Patched versions: 4.16.14

Original Wordfence record

MediumCVE-2026-4949

ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription

Published: April 15, 2026

Affected versions: *-4.16.12
Patched versions: 4.16.13

Original Wordfence record

MediumCVE-2026-3309

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields

Published: April 3, 2026

Affected versions: *-4.16.11
Patched versions: 4.16.12

Original Wordfence record

HighCVE-2026-3445

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass

Published: April 3, 2026

Affected versions: *-4.16.11
Patched versions: 4.16.12

Original Wordfence record

HighCVE-2026-3453

ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration

Published: March 10, 2026

Affected versions: *-4.16.11
Patched versions: 4.16.12

Original Wordfence record

MediumCVE-2025-13642

ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

Published: December 8, 2025

Affected versions: *-4.16.7
Patched versions: 4.16.8

Original Wordfence record

Highest-Severity Records

CriticalCVE-2021-34623

User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation

Published: June 28, 2021

Affected versions: 3.0.0-3.1.3
Patched versions: 3.1.4

Original Wordfence record

CriticalCVE-2021-34624

ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload

Published: June 28, 2021

Affected versions: 3.0.0-3.1.3
Patched versions: 3.1.4

Original Wordfence record

CriticalCVE-2021-34621

User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation

Published: June 28, 2021

Affected versions: 3.0.0-3.1.3
Patched versions: 3.1.4

Original Wordfence record

CriticalCVE-2021-34622

ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation

Published: June 28, 2021

Affected versions: 3.0.0-3.1.3
Patched versions: 3.1.4

Original Wordfence record

CriticalCVE-2026-12497

ProfilePress <= 4.16.17 - Unauthenticated Privilege Escalation

Published: July 3, 2026

Affected versions: *-4.16.17
Patched versions: 4.16.18

Original Wordfence record

HighCVE-2026-13352

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion

Published: July 16, 2026

Affected versions: *-4.16.18
Patched versions: 4.16.19

Original Wordfence record

HighCVE-2026-3453

ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration

Published: March 10, 2026

Affected versions: *-4.16.11
Patched versions: 4.16.12

Original Wordfence record

HighCVE-2023-41954

ProfilePress <= 4.13.1 - Limited Privilege Escalation via 'acceptable_defined_roles'

Published: September 9, 2023

Affected versions: [*, 4.13.2)
Patched versions: 4.13.2

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory