WordPress plugin
PeproDev Ultimate Profile Solutions security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 4 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High1
- Medium2
- Low0
All PeproDev Ultimate Profile Solutions vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Critical9.8 | 7.5.2 - Authentication Bypass to Account Takeover 1.9.1 – 7.5.2Update to 8.0.0 | CVE-2025-3844 | |
| High8.2 | 7.5.2 - Missing Authorization to Limited Unauthenticated Arbitrary User Meta Update via handel_ajax_req Function 1.9.1 – 7.5.2Update to 8.0.0 | CVE-2025-3921 |
- Critical9.87.5.2 - Authentication Bypass to Account Takeover
1.9.1 – 7.5.2Update to 8.0.0
- High8.27.5.2 - Missing Authorization to Limited Unauthenticated Arbitrary User Meta Update via handel_ajax_req Function
1.9.1 – 7.5.2Update to 8.0.0
PeproDev Ultimate Profile Solutions: common questions
Does PeproDev Ultimate Profile Solutions have known vulnerabilities?
Yes. VulnCrest Radar lists 4 known vulnerabilities in PeproDev Ultimate Profile Solutions: 1 critical, 1 high, 2 medium. None are known to affect version null.
How do I check which version of PeproDev Ultimate Profile Solutions I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent PeproDev Ultimate Profile Solutions vulnerability?
CVE-2026-4791, published Oct 9, 2026: PeproDev Ultimate Profile Solutions <= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute. Severity: Medium (CVSS 6.4).
Is any PeproDev Ultimate Profile Solutions vulnerability listed in CISA KEV?
No. None of the known PeproDev Ultimate Profile Solutions vulnerabilities is currently listed in the CISA KEV catalog.