Properfraction
Properfraction Profilepress: vulnerabilities and CVEs
Properfraction Profilepress has 34 published vulnerabilities, 0 of them in the last 12 months. 4 are rated critical and 0 are listed by CISA as actively exploited.
CVEs34
Last 12 months0
Critical4
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2024-13121 | Low (3.5) | 0.32% | — | Feb 13, 2025 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which could allow high… |
| CVE-2024-13120 | Medium (4.8) | 0.31% | — | Feb 13, 2025 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which could allow high… |
| CVE-2024-13119 | Medium (4.8) | 0.36% | — | Feb 13, 2025 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which could allow high… |
| CVE-2024-10518 | Medium (4.8) | 0.35% | — | Dec 12, 2024 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Membership Plan settings, which could… |
| CVE-2024-10517 | Medium (4.8) | 0.35% | — | Dec 12, 2024 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Drag & Drop Builder fields, which could… |
| CVE-2023-41953 | Medium (5.3) | 0.41% | — | Dec 9, 2024 | Missing Authorization vulnerability in ProfilePress Membership Team ProfilePress.This issue affects ProfilePress: from n/a through 4.13.1. |
| CVE-2023-50882 | Medium (5.3) | 0.50% | — | Dec 9, 2024 | Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through <= 4.13.2. |
| CVE-2024-11083 | Medium (5.3) | 0.41% | — | Nov 27, 2024 | The ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.15.18 via the WordPress core search feature. This makes it possible for unauthenticated… |
| CVE-2024-9947 | Critical (9.8) | 0.53% | — | Oct 23, 2024 | The ProfilePress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.11.1. This is due to insufficient verification on the user being returned by the social login… |
| CVE-2024-2861 | Medium (5.4) | 0.29% | — | May 23, 2024 | The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ProfilePress User Panel widget in all versions up to, and including, 4.15.8 due to insufficient input sanitization and output… |
| CVE-2023-41954 | High (8.6) | 1.3% | — | May 17, 2024 | Improper Privilege Management vulnerability in ProfilePress Membership Team ProfilePress allows Privilege Escalation.This issue affects ProfilePress: from n/a through 4.13.1. |
| CVE-2024-2867 | Medium (5.4) | 0.38% | — | May 2, 2024 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in… |
| CVE-2024-3210 | Medium (5.4) | 0.43% | — | Apr 10, 2024 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's… |
| CVE-2024-1806 | Medium (5.4) | 0.56% | — | Mar 13, 2024 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s)… |
| CVE-2024-1535 | Medium (5.4) | 0.57% | — | Mar 13, 2024 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s)… |
| CVE-2024-1409 | Medium (5.4) | 0.44% | — | Mar 13, 2024 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's… |
| CVE-2024-1570 | Medium (5.4) | 0.48% | — | Feb 29, 2024 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's login-password… |
| CVE-2024-1519 | Medium (6.1) | 0.57% | — | Feb 29, 2024 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all… |
| CVE-2024-1408 | Medium (5.4) | 0.60% | — | Feb 29, 2024 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's… |
| CVE-2024-1046 | Medium (5.4) | 0.37% | — | Feb 5, 2024 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin… |
| CVE-2022-45083 | High (7.2) | 0.58% | — | Jan 19, 2024 | Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects… |
| CVE-2023-44150 | High (7.5) | 0.66% | — | Nov 30, 2023 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content –… |
| CVE-2023-23830 | Medium (6.1) | 0.41% | — | May 3, 2023 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.4 versions. |
| CVE-2023-23820 | Medium (5.4) | 0.41% | — | May 3, 2023 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.4 versions. |
| CVE-2023-23996 | Medium (4.8) | 0.42% | — | Apr 6, 2023 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.3 versions. |
| CVE-2022-47444 | Medium (6.1) | 0.41% | — | Mar 29, 2023 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin <= 4.5.3… |
| CVE-2022-4698 | Medium (4.8) | 0.63% | — | Dec 23, 2022 | The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several form fields in versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes… |
| CVE-2022-4697 | Medium (4.8) | 0.68% | — | Dec 23, 2022 | The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_user_cover_default_image_url’ parameter in versions up to, and including, 4.5.0 due to insufficient input sanitization and… |
| CVE-2021-24522 | Medium (6.1) | 1.6% | — | Aug 9, 2021 | The User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for tabbed login/register was not properly escaped and could be used in an XSS… |
| CVE-2021-24450 | Medium (4.8) | 0.65% | — | Aug 2, 2021 | The User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and outputting them back… |
🎯 How it gets exploited (ATT&CK techniques)
Number of CVEs of this technology mapped to each exploitation or primary-impact technique.