WordPress plugin
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 60 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical5
- High12
- Medium43
- Low0
All ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content vulnerabilities
- High7.3Unauthenticated Arbitrary Shortcode Execution
≤4.17.7Update to 4.18.0
- High8.8Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields
≤4.17.4Update to 4.17.5
- High8.1Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)
≤4.17.2Update to 4.17.3
- High8.1Unauthenticated Arbitrary Plugin Installation via Brute Force
≤4.17.1Update to 4.17.2
- High7.3Unauthenticated Arbitrary Shortcode Execution
<4.17.1Update to 4.17.1
- High8.8Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion
≤4.16.18Update to 4.16.19
- Critical9.8Unauthenticated Privilege Escalation
≤4.16.17Update to 4.16.18
- High7.1Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass
≤4.16.11Update to 4.16.12
- High8.1Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration
≤4.16.11Update to 4.16.12
- High7.3Limited Privilege Escalation via 'acceptable_defined_roles'
<4.13.2Update to 4.13.2
- High7.2Unauthenticated Cross-Site Scripting
≤4.5.3Update to 4.5.4
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.5.4Update to 4.5.5
- High7.2Unauthenticated Cross-Site Scripting
≤3.1.10Update to 3.1.11
- Critical9.83.1.3 - Unauthenticated Privilege Escalation
3.0.0 – 3.1.3Update to 3.1.4
- Critical9.83.1.3 - Arbitrary File Upload
3.0.0 – 3.1.3Update to 3.1.4
- Critical9.83.1.3 - Unauthenticated Privilege Escalation
3.0.0 – 3.1.3Update to 3.1.4
- Critical9.83.1.3 - Unauthenticated Privilege Escalation
3.0.0 – 3.1.3Update to 3.1.4
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content: common questions
Does ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content have known vulnerabilities?
Yes. VulnCrest Radar lists 60 known vulnerabilities in ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content: 5 critical, 12 high, 43 medium. None are known to affect version null.
How do I check which version of ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content vulnerability?
CVE-2026-123656, published Nov 11, 2026: ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content < 4.17.6 - Missing Authorization. Severity: Medium (CVSS 5.3).
Is any ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content vulnerability listed in CISA KEV?
No. None of the known ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content vulnerabilities is currently listed in the CISA KEV catalog.