WordPress plugin
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 60 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical5
- High12
- Medium43
- Low0
All ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content vulnerabilities
- Medium5.3Missing Authorization
<4.17.6Update to 4.17.6
- Medium5.3Missing Authorization
<4.17.6Update to 4.17.6
- Medium4.34.17.3 - Missing Authorization
4.16.13 – 4.17.3Update to 4.17.4
- High7.3Unauthenticated Arbitrary Shortcode Execution
≤4.17.7Update to 4.18.0
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution
≤4.17.7Update to 4.18.0
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab
≤4.17.5Update to 4.17.6
- Medium6.1Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter
≤4.17.4Update to 4.17.5
- High8.8Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields
≤4.17.4Update to 4.17.5
- Medium4.3Missing Authorization
≤4.17.3Update to 4.17.4
- Medium5.3Missing Authorization
≤4.17.3Update to 4.17.4
- High8.1Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)
≤4.17.2Update to 4.17.3
- High8.1Unauthenticated Arbitrary Plugin Installation via Brute Force
≤4.17.1Update to 4.17.2
- High7.3Unauthenticated Arbitrary Shortcode Execution
<4.17.1Update to 4.17.1
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field
≤4.16.19Update to 4.17.0
- High8.8Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion
≤4.16.18Update to 4.16.19
- Critical9.8Unauthenticated Privilege Escalation
≤4.16.17Update to 4.16.18
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation
≤4.16.16Update to 4.16.17
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤4.16.13Update to 4.16.14
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription
≤4.16.12Update to 4.16.13
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields
≤4.16.11Update to 4.16.12
- High7.1Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass
≤4.16.11Update to 4.16.12
- High8.1Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration
≤4.16.11Update to 4.16.12
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution
≤4.16.7Update to 4.16.8
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
≤4.16.4Update to 4.16.5
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤4.15.19Update to 4.15.20
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤4.15.19Update to 4.15.20
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤4.15.19Update to 4.15.20
- Medium5.3Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
≤4.15.18Update to 4.15.19
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting via "Labels"
≤4.15.14Update to 4.15.15
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting via "Product Files"
≤4.15.14Update to 4.15.15
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget
≤4.15.8Update to 4.15.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.15.4Update to 4.15.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'reg-single-checkbox'
≤4.15.5Update to 4.15.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤4.15.2Update to 4.15.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode
≤4.15.1Update to 4.15.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via [reg-select-role] Shortcode
≤4.15.0Update to 4.15.1
- Medium6.5Unauthenticated Stored Cross-Site Scripting
≤4.14.4Update to 4.15.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤4.14.4Update to 4.15.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcode
≤4.14.4Update to 4.15.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.14.3Update to 4.14.4
- Medium5.3Information Disclosure via Debug Log
≤4.13.2Update to 4.13.3
- High7.3Limited Privilege Escalation via 'acceptable_defined_roles'
<4.13.2Update to 4.13.2
- Medium4.3ProfilePress <= 4.13.1 Cross-Site Request Forgery via 'admin_notice'
<4.13.2Update to 4.13.2
- Medium6.1Reflected Cross-Site Scripting via error message
<4.11.0Update to 4.11.0
- High7.2Unauthenticated Cross-Site Scripting
≤4.5.3Update to 4.5.4
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.5.4Update to 4.5.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
≤4.5.4Update to 4.5.5
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
≤4.5.3Update to 4.5.4
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting via Form Settings
≤4.5.0Update to 4.5.1
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
≤4.5.0Update to 4.5.1
- Medium6.6Authenticated (Admin+) PHP Object Injection
≤4.3.2Update to 4.4.0
- Medium6.1Reflected Cross-Site Scripting
≤3.2.15Update to 3.2.16
- Medium6.1Reflected Cross-Site Scripting
<3.2.3Update to 3.2.3
- Medium6.1Reflected Cross-Site Scripting via ppress_cc_data Parameter
<3.2.3Update to 3.2.3
- High7.2Unauthenticated Cross-Site Scripting
≤3.1.10Update to 3.1.11
- Critical9.83.1.3 - Unauthenticated Privilege Escalation
3.0.0 – 3.1.3Update to 3.1.4
- Critical9.83.1.3 - Arbitrary File Upload
3.0.0 – 3.1.3Update to 3.1.4
- Critical9.83.1.3 - Unauthenticated Privilege Escalation
3.0.0 – 3.1.3Update to 3.1.4
- Critical9.83.1.3 - Unauthenticated Privilege Escalation
3.0.0 – 3.1.3Update to 3.1.4
- Medium5.5Authenticated Stored Cross-Site Scripting
<3.1.8Update to 3.1.8
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content: common questions
Does ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content have known vulnerabilities?
Yes. VulnCrest Radar lists 60 known vulnerabilities in ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content: 5 critical, 12 high, 43 medium. None are known to affect version null.
How do I check which version of ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content vulnerability?
CVE-2026-123656, published Nov 11, 2026: ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content < 4.17.6 - Missing Authorization. Severity: Medium (CVSS 5.3).
Is any ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content vulnerability listed in CISA KEV?
No. None of the known ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content vulnerabilities is currently listed in the CISA KEV catalog.