Paid Membership Plugin Ecommerce User Registration Form Login Form User Profile Restrict Content Profilepress
Monthly
Sensitive information exposure in the ProfilePress WordPress plugin (wp-user-avatar), affecting all versions up to and including 4.17.4, allows an authenticated attacker with subscriber-level access or above to read other users' email addresses, login names, and registration dates by supplying attacker-controlled base64 payloads to the [pp-custom-html] shortcode that invoke [profile-email], [profile-username], and [profile-date-registered] through the Member Directory's per-row user rebinding logic in get_user_profile_structure. When WordPress self-registration is enabled (users_can_register), the same leak becomes reachable without authentication, because the plugin's registration handler processes the reg_nickname and reg_bio fields without a nonce check and can carry the split shortcode fragments. Impact is confidentiality-only - the exposed data is limited to emails, usernames, and registration timestamps, not passwords or session material - and neither CISA KEV listing nor public exploit code has been identified at time of analysis; the Wordfence advisory is the primary vendor-adjacent reference.
Authenticated users with subscriber-level access or higher can execute arbitrary WordPress shortcodes through the ProfilePress plugin (slug wp-user-avatar) in all versions up to and including 4.17.2, because user-controlled values reach do_shortcode() without validation. Exploitation requires a low-privilege account, which is trivially obtained on sites that enable the plugin's self-service registration feature, and no user interaction is needed; however, the practical impact is variable and often limited, since substantial confidentiality or integrity loss only materializes when other privileged or data-exposing shortcodes are registered on the same site. The vendor's upstream severity rating is 8.1, while independent assessment rates the realistic vector as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (limited C/I, no availability impact); no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Remote code execution is possible in the ProfilePress WordPress plugin (Paid Membership, Ecommerce, User Registration) in all versions through 4.16.18, where the DigitalProducts UploadHandler unconditionally registers an upload_mimes filter that whitelists executable extensions (.exe, .apk, .msi) across every WordPress upload context site-wide. Authenticated attackers with author-level access or above (per CVSS PR:L) can leverage this expanded MIME allowlist to upload executable files, leading to code execution. There is no public exploit identified at time of analysis, and this CVE is not listed in CISA KEV.
Authenticated attackers with subscriber-level access can obtain paid lifetime membership plans in the ProfilePress WordPress plugin (≤4.16.11) without payment by exploiting a missing ownership verification flaw. The vulnerability allows hijacking of another user's active subscription during checkout to manipulate proration calculations. With a 7.1 CVSS score, low attack complexity, and requiring only low-privilege authentication, this presents a significant revenue loss risk for sites using ProfilePress for paid memberships. No public exploit identified at time of analysis, though EPSS data not available. Vendor patch released in version 4.16.12.
Arbitrary shortcode execution in the ProfilePress (formerly WP User Avatar) WordPress plugin through version 4.17.5 allows authenticated users with Subscriber-level access or higher to plant shortcode markup inside a comment, which is later rendered server-side by do_shortcode() when any visitor opens that user's front-end profile Comments tab. Because the plugin's ppress_neutralize_buffer_shortcodes() pass only strips pp-custom-html and bracket fragments containing HTML delimiters, shortcodes exposed by any other active plugin or theme remain intact and can be executed with attacker-chosen attributes, giving a low-privilege user a route to capability-gated or data-returning shortcodes and to raw HTML injection on a publicly viewable page. Rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), the impact is bounded by which shortcodes a given site happens to have installed, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Reflected cross-site scripting (XSS) in the ProfilePress WordPress plugin versions up to and including 4.17.4 allows unauthenticated attackers to inject arbitrary web scripts via a crafted POST request with a malicious ppress_billing_address filename, which executes in a victim's browser when they are tricked into clicking a link. Exploitation requires that the affected site hosts the ProfilePress Tabbed Widget; sites not using this widget are not exposed. This moderate-severity flaw (CVSS 6.1) has no public exploit identified at time of analysis and is not confirmed as actively exploited (CISA KEV).
Arbitrary shortcode execution in ProfilePress (WordPress plugin) versions through 4.16.19 permits authenticated attackers holding only subscriber-level accounts to inject and run arbitrary WordPress shortcodes within the site context. The plugin's partial mitigation - applying strip_shortcodes() to [profile-first-name] and [profile-last-name] fields - is bypassed via at least three confirmed paths: the [profile-display-name format="first_last_names"] render chain, the [profile-bio] field (which re-fetches raw user_description meta, bypassing the sanitized value), and the double-bracket escape sequence [[tag]] that passes through strip_shortcodes() unmodified but is resolved by the outer do_shortcode() call. No public exploit code has been confirmed at time of analysis, but the low authentication bar (self-registration is the plugin's core use case) and three documented bypass vectors make this a meaningful risk on open-registration membership sites.
Missing authorization check in ProfilePress (WordPress membership plugin) versions ≤4.16.12 allows authenticated attackers (Subscriber+) to subscribe to inactive membership plans via a manipulated checkout request. This bypasses plan status enforcement, potentially granting access to restricted content without proper validation. EPSS indicates low exploitation probability, and no active exploitation or public exploit
Arbitrary shortcode execution in ProfilePress plugin for WordPress (all versions up to 4.16.11) allows unauthenticated attackers to execute arbitrary shortcodes by injecting malicious code into billing field values during checkout, potentially leading to information disclosure or content manipulation. The vulnerability stems from insufficient sanitization of user-supplied input before shortcode processing. Wordfence has documented this issue with a CVSS score of 6.5 and no confirmed active exploitation at time of analysis.
Sensitive information exposure in the ProfilePress WordPress plugin (wp-user-avatar), affecting all versions up to and including 4.17.4, allows an authenticated attacker with subscriber-level access or above to read other users' email addresses, login names, and registration dates by supplying attacker-controlled base64 payloads to the [pp-custom-html] shortcode that invoke [profile-email], [profile-username], and [profile-date-registered] through the Member Directory's per-row user rebinding logic in get_user_profile_structure. When WordPress self-registration is enabled (users_can_register), the same leak becomes reachable without authentication, because the plugin's registration handler processes the reg_nickname and reg_bio fields without a nonce check and can carry the split shortcode fragments. Impact is confidentiality-only - the exposed data is limited to emails, usernames, and registration timestamps, not passwords or session material - and neither CISA KEV listing nor public exploit code has been identified at time of analysis; the Wordfence advisory is the primary vendor-adjacent reference.
Authenticated users with subscriber-level access or higher can execute arbitrary WordPress shortcodes through the ProfilePress plugin (slug wp-user-avatar) in all versions up to and including 4.17.2, because user-controlled values reach do_shortcode() without validation. Exploitation requires a low-privilege account, which is trivially obtained on sites that enable the plugin's self-service registration feature, and no user interaction is needed; however, the practical impact is variable and often limited, since substantial confidentiality or integrity loss only materializes when other privileged or data-exposing shortcodes are registered on the same site. The vendor's upstream severity rating is 8.1, while independent assessment rates the realistic vector as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (limited C/I, no availability impact); no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Remote code execution is possible in the ProfilePress WordPress plugin (Paid Membership, Ecommerce, User Registration) in all versions through 4.16.18, where the DigitalProducts UploadHandler unconditionally registers an upload_mimes filter that whitelists executable extensions (.exe, .apk, .msi) across every WordPress upload context site-wide. Authenticated attackers with author-level access or above (per CVSS PR:L) can leverage this expanded MIME allowlist to upload executable files, leading to code execution. There is no public exploit identified at time of analysis, and this CVE is not listed in CISA KEV.
Authenticated attackers with subscriber-level access can obtain paid lifetime membership plans in the ProfilePress WordPress plugin (≤4.16.11) without payment by exploiting a missing ownership verification flaw. The vulnerability allows hijacking of another user's active subscription during checkout to manipulate proration calculations. With a 7.1 CVSS score, low attack complexity, and requiring only low-privilege authentication, this presents a significant revenue loss risk for sites using ProfilePress for paid memberships. No public exploit identified at time of analysis, though EPSS data not available. Vendor patch released in version 4.16.12.
Arbitrary shortcode execution in the ProfilePress (formerly WP User Avatar) WordPress plugin through version 4.17.5 allows authenticated users with Subscriber-level access or higher to plant shortcode markup inside a comment, which is later rendered server-side by do_shortcode() when any visitor opens that user's front-end profile Comments tab. Because the plugin's ppress_neutralize_buffer_shortcodes() pass only strips pp-custom-html and bracket fragments containing HTML delimiters, shortcodes exposed by any other active plugin or theme remain intact and can be executed with attacker-chosen attributes, giving a low-privilege user a route to capability-gated or data-returning shortcodes and to raw HTML injection on a publicly viewable page. Rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), the impact is bounded by which shortcodes a given site happens to have installed, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Reflected cross-site scripting (XSS) in the ProfilePress WordPress plugin versions up to and including 4.17.4 allows unauthenticated attackers to inject arbitrary web scripts via a crafted POST request with a malicious ppress_billing_address filename, which executes in a victim's browser when they are tricked into clicking a link. Exploitation requires that the affected site hosts the ProfilePress Tabbed Widget; sites not using this widget are not exposed. This moderate-severity flaw (CVSS 6.1) has no public exploit identified at time of analysis and is not confirmed as actively exploited (CISA KEV).
Arbitrary shortcode execution in ProfilePress (WordPress plugin) versions through 4.16.19 permits authenticated attackers holding only subscriber-level accounts to inject and run arbitrary WordPress shortcodes within the site context. The plugin's partial mitigation - applying strip_shortcodes() to [profile-first-name] and [profile-last-name] fields - is bypassed via at least three confirmed paths: the [profile-display-name format="first_last_names"] render chain, the [profile-bio] field (which re-fetches raw user_description meta, bypassing the sanitized value), and the double-bracket escape sequence [[tag]] that passes through strip_shortcodes() unmodified but is resolved by the outer do_shortcode() call. No public exploit code has been confirmed at time of analysis, but the low authentication bar (self-registration is the plugin's core use case) and three documented bypass vectors make this a meaningful risk on open-registration membership sites.
Missing authorization check in ProfilePress (WordPress membership plugin) versions ≤4.16.12 allows authenticated attackers (Subscriber+) to subscribe to inactive membership plans via a manipulated checkout request. This bypasses plan status enforcement, potentially granting access to restricted content without proper validation. EPSS indicates low exploitation probability, and no active exploitation or public exploit
Arbitrary shortcode execution in ProfilePress plugin for WordPress (all versions up to 4.16.11) allows unauthenticated attackers to execute arbitrary shortcodes by injecting malicious code into billing field values during checkout, potentially leading to information disclosure or content manipulation. The vulnerability stems from insufficient sanitization of user-supplied input before shortcode processing. Wordfence has documented this issue with a CVSS score of 6.5 and no confirmed active exploitation at time of analysis.