Properfraction
Monthly
Unauthenticated attackers can take over any WordPress user account, including administrators, on sites running the MailOptin plugin up to version 1.2.78.6 that have a 'WordPress User Registration' opt-in form published. The flaw allows manipulation of the optin_data[form_custom_field_mappings] parameter to override saved mappings, enabling injection of arbitrary wp_users column names (e.g., ID, user_pass) into wp_insert_user(), which then updates the target account's password. No authentication, nonce, or capability check is required, and the only prerequisite is the presence of the registration form; sites using MailOptin solely for mailing-list optins without this connection are not affected. No public exploit identified at time of analysis.
Sensitive information exposure in the ProfilePress WordPress plugin (wp-user-avatar), affecting all versions up to and including 4.17.4, allows an authenticated attacker with subscriber-level access or above to read other users' email addresses, login names, and registration dates by supplying attacker-controlled base64 payloads to the [pp-custom-html] shortcode that invoke [profile-email], [profile-username], and [profile-date-registered] through the Member Directory's per-row user rebinding logic in get_user_profile_structure. When WordPress self-registration is enabled (users_can_register), the same leak becomes reachable without authentication, because the plugin's registration handler processes the reg_nickname and reg_bio fields without a nonce check and can carry the split shortcode fragments. Impact is confidentiality-only - the exposed data is limited to emails, usernames, and registration timestamps, not passwords or session material - and neither CISA KEV listing nor public exploit code has been identified at time of analysis; the Wordfence advisory is the primary vendor-adjacent reference.
Authenticated users with subscriber-level access or higher can execute arbitrary WordPress shortcodes through the ProfilePress plugin (slug wp-user-avatar) in all versions up to and including 4.17.2, because user-controlled values reach do_shortcode() without validation. Exploitation requires a low-privilege account, which is trivially obtained on sites that enable the plugin's self-service registration feature, and no user interaction is needed; however, the practical impact is variable and often limited, since substantial confidentiality or integrity loss only materializes when other privileged or data-exposing shortcodes are registered on the same site. The vendor's upstream severity rating is 8.1, while independent assessment rates the realistic vector as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (limited C/I, no availability impact); no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Remote code execution is possible in the ProfilePress WordPress plugin (Paid Membership, Ecommerce, User Registration) in all versions through 4.16.18, where the DigitalProducts UploadHandler unconditionally registers an upload_mimes filter that whitelists executable extensions (.exe, .apk, .msi) across every WordPress upload context site-wide. Authenticated attackers with author-level access or above (per CVSS PR:L) can leverage this expanded MIME allowlist to upload executable files, leading to code execution. There is no public exploit identified at time of analysis, and this CVE is not listed in CISA KEV.
Privilege escalation in the MailOptin WordPress plugin (by properfraction) affects all versions up to and including 1.2.77.3, stemming from incorrect privilege assignment (CWE-266). An attacker can obtain elevated privileges within the WordPress site, potentially reaching administrator-level control that yields full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported by Patchstack.
Authenticated attackers with subscriber-level access can obtain paid lifetime membership plans in the ProfilePress WordPress plugin (≤4.16.11) without payment by exploiting a missing ownership verification flaw. The vulnerability allows hijacking of another user's active subscription during checkout to manipulate proration calculations. With a 7.1 CVSS score, low attack complexity, and requiring only low-privilege authentication, this presents a significant revenue loss risk for sites using ProfilePress for paid memberships. No public exploit identified at time of analysis, though EPSS data not available. Vendor patch released in version 4.16.12.
Arbitrary shortcode execution in the ProfilePress (formerly WP User Avatar) WordPress plugin through version 4.17.5 allows authenticated users with Subscriber-level access or higher to plant shortcode markup inside a comment, which is later rendered server-side by do_shortcode() when any visitor opens that user's front-end profile Comments tab. Because the plugin's ppress_neutralize_buffer_shortcodes() pass only strips pp-custom-html and bracket fragments containing HTML delimiters, shortcodes exposed by any other active plugin or theme remain intact and can be executed with attacker-chosen attributes, giving a low-privilege user a route to capability-gated or data-returning shortcodes and to raw HTML injection on a publicly viewable page. Rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), the impact is bounded by which shortcodes a given site happens to have installed, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Missing authorization in the ProfilePress (wp-user-avatar) WordPress plugin through 4.17.3 allows an authenticated user with only low privileges to perform state-changing actions that should require higher-level capabilities, resulting in unauthorized modification of site data. The flaw is exploitable remotely over the network with low complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base score 6.5), with impact confined to integrity; confidentiality and availability are unaffected per the assessed vector. No public exploit code and no active exploitation have been identified at time of analysis, and exposure is meaningfully reduced on sites that restrict or disable open user registration, since the attacker must first hold a valid low-privilege WordPress account.
ProfilePress versions up to and including 4.17.3 contain a missing authorization vulnerability (CWE-862) that allows unauthenticated remote attackers to bypass incorrectly configured access control checks, potentially leading to unauthorized modification of site data. The flaw requires a specific high-complexity configuration condition (CVSS AC:H) to be exploitable, but when present, it can compromise integrity; confidentiality and availability are unaffected. No public exploit code or active exploitation has been identified at the time of analysis, and the CVSS score is 5.9, reflecting a moderate-severity, high-CVSS-but-tempered-real-risk issue.
Reflected cross-site scripting (XSS) in the ProfilePress WordPress plugin versions up to and including 4.17.4 allows unauthenticated attackers to inject arbitrary web scripts via a crafted POST request with a malicious ppress_billing_address filename, which executes in a victim's browser when they are tricked into clicking a link. Exploitation requires that the affected site hosts the ProfilePress Tabbed Widget; sites not using this widget are not exposed. This moderate-severity flaw (CVSS 6.1) has no public exploit identified at time of analysis and is not confirmed as actively exploited (CISA KEV).
Unauthenticated shortcode injection in the kk Star Ratings - Rate Post & Collect User Feedbacks WordPress plugin (all versions through 5.4.10.3) allows any remote, unauthenticated attacker to execute arbitrary WordPress shortcodes by supplying a crafted payload to the plugin's AJAX handler. The flaw exists because the wp_ajax_kk-star-ratings action passes a user-controlled 'payload' parameter directly to do_shortcode() without allowlisting or sanitizing which shortcode tags are permitted. No public exploit has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog; however, threat intelligence sources tag this as RCE, indicating that practical impact can escalate significantly depending on what shortcodes co-installed plugins register.
Arbitrary shortcode execution in ProfilePress (WordPress plugin) versions through 4.16.19 permits authenticated attackers holding only subscriber-level accounts to inject and run arbitrary WordPress shortcodes within the site context. The plugin's partial mitigation - applying strip_shortcodes() to [profile-first-name] and [profile-last-name] fields - is bypassed via at least three confirmed paths: the [profile-display-name format="first_last_names"] render chain, the [profile-bio] field (which re-fetches raw user_description meta, bypassing the sanitized value), and the double-bracket escape sequence [[tag]] that passes through strip_shortcodes() unmodified but is resolved by the outer do_shortcode() call. No public exploit code has been confirmed at time of analysis, but the low authentication bar (self-registration is the plugin's core use case) and three documented bypass vectors make this a meaningful risk on open-registration membership sites.
Stored Cross-Site Scripting in MailOptin WordPress plugin (versions ≤ 1.2.78.0) allows Contributor-level authenticated users to inject malicious JavaScript payloads that execute in the browser context of higher-privileged users - typically site administrators - when they view the affected content. The CVSS scope change (S:C) confirms the injected script escapes the contributor's own context, making this an effective privilege escalation vector in multi-author WordPress environments. No public exploit code or active exploitation has been identified at time of analysis.
Cross-Site Request Forgery in the CrawlWP SEO WordPress plugin (versions through 3.0.16) allows an unauthenticated attacker to perform unauthorized state-changing actions on behalf of an authenticated site administrator. Exploitation requires social engineering - a logged-in admin must be tricked into visiting a malicious page that silently submits a forged request. The integrity impact is low, limited to unauthorized configuration changes within the plugin's functionality. No public exploit code or active exploitation has been identified at time of analysis, consistent with the vulnerability's low CVSS base score of 4.3.
Cross-site scripting in ProfilePress WordPress plugin versions up to and including 4.16.13 allows authenticated subscribers to inject malicious JavaScript payloads that execute in the browsers of other users - including administrators - who view affected content. The CVSS scope change (S:C) indicator confirms this is a stored or reflected XSS that crosses privilege boundaries, enabling low-privilege users to target higher-privilege accounts. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Missing authorization check in ProfilePress (WordPress membership plugin) versions ≤4.16.12 allows authenticated attackers (Subscriber+) to subscribe to inactive membership plans via a manipulated checkout request. This bypasses plan status enforcement, potentially granting access to restricted content without proper validation. EPSS indicates low exploitation probability, and no active exploitation or public exploit
Arbitrary shortcode execution in ProfilePress plugin for WordPress (all versions up to 4.16.11) allows unauthenticated attackers to execute arbitrary shortcodes by injecting malicious code into billing field values during checkout, potentially leading to information disclosure or content manipulation. The vulnerability stems from insufficient sanitization of user-supplied input before shortcode processing. Wordfence has documented this issue with a CVSS score of 6.5 and no confirmed active exploitation at time of analysis.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Membership Plan. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Drag & Drop Builder. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.13.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.15.18 via the WordPress core search feature. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The ProfilePress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.11.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ProfilePress User Panel widget in all versions up to, and including, 4.15.8 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content -. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in Collins Agbonghama Admin Bar & Dashboard Access Control admin-bar-dashboard-control.2.8. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several form fields in versions up to, and including, 4.5.0 due to insufficient input sanitization and output. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_user_cover_default_image_url’ parameter in versions up to, and including, 4.5.0 due to insufficient. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The User Registration, User Profile, Login & Membership - ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for tabbed login/register was not properly escaped and could. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The User Registration, User Profiles, Login & Membership - ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible for users to escalate their privileges. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated attackers can take over any WordPress user account, including administrators, on sites running the MailOptin plugin up to version 1.2.78.6 that have a 'WordPress User Registration' opt-in form published. The flaw allows manipulation of the optin_data[form_custom_field_mappings] parameter to override saved mappings, enabling injection of arbitrary wp_users column names (e.g., ID, user_pass) into wp_insert_user(), which then updates the target account's password. No authentication, nonce, or capability check is required, and the only prerequisite is the presence of the registration form; sites using MailOptin solely for mailing-list optins without this connection are not affected. No public exploit identified at time of analysis.
Sensitive information exposure in the ProfilePress WordPress plugin (wp-user-avatar), affecting all versions up to and including 4.17.4, allows an authenticated attacker with subscriber-level access or above to read other users' email addresses, login names, and registration dates by supplying attacker-controlled base64 payloads to the [pp-custom-html] shortcode that invoke [profile-email], [profile-username], and [profile-date-registered] through the Member Directory's per-row user rebinding logic in get_user_profile_structure. When WordPress self-registration is enabled (users_can_register), the same leak becomes reachable without authentication, because the plugin's registration handler processes the reg_nickname and reg_bio fields without a nonce check and can carry the split shortcode fragments. Impact is confidentiality-only - the exposed data is limited to emails, usernames, and registration timestamps, not passwords or session material - and neither CISA KEV listing nor public exploit code has been identified at time of analysis; the Wordfence advisory is the primary vendor-adjacent reference.
Authenticated users with subscriber-level access or higher can execute arbitrary WordPress shortcodes through the ProfilePress plugin (slug wp-user-avatar) in all versions up to and including 4.17.2, because user-controlled values reach do_shortcode() without validation. Exploitation requires a low-privilege account, which is trivially obtained on sites that enable the plugin's self-service registration feature, and no user interaction is needed; however, the practical impact is variable and often limited, since substantial confidentiality or integrity loss only materializes when other privileged or data-exposing shortcodes are registered on the same site. The vendor's upstream severity rating is 8.1, while independent assessment rates the realistic vector as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (limited C/I, no availability impact); no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Remote code execution is possible in the ProfilePress WordPress plugin (Paid Membership, Ecommerce, User Registration) in all versions through 4.16.18, where the DigitalProducts UploadHandler unconditionally registers an upload_mimes filter that whitelists executable extensions (.exe, .apk, .msi) across every WordPress upload context site-wide. Authenticated attackers with author-level access or above (per CVSS PR:L) can leverage this expanded MIME allowlist to upload executable files, leading to code execution. There is no public exploit identified at time of analysis, and this CVE is not listed in CISA KEV.
Privilege escalation in the MailOptin WordPress plugin (by properfraction) affects all versions up to and including 1.2.77.3, stemming from incorrect privilege assignment (CWE-266). An attacker can obtain elevated privileges within the WordPress site, potentially reaching administrator-level control that yields full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported by Patchstack.
Authenticated attackers with subscriber-level access can obtain paid lifetime membership plans in the ProfilePress WordPress plugin (≤4.16.11) without payment by exploiting a missing ownership verification flaw. The vulnerability allows hijacking of another user's active subscription during checkout to manipulate proration calculations. With a 7.1 CVSS score, low attack complexity, and requiring only low-privilege authentication, this presents a significant revenue loss risk for sites using ProfilePress for paid memberships. No public exploit identified at time of analysis, though EPSS data not available. Vendor patch released in version 4.16.12.
Arbitrary shortcode execution in the ProfilePress (formerly WP User Avatar) WordPress plugin through version 4.17.5 allows authenticated users with Subscriber-level access or higher to plant shortcode markup inside a comment, which is later rendered server-side by do_shortcode() when any visitor opens that user's front-end profile Comments tab. Because the plugin's ppress_neutralize_buffer_shortcodes() pass only strips pp-custom-html and bracket fragments containing HTML delimiters, shortcodes exposed by any other active plugin or theme remain intact and can be executed with attacker-chosen attributes, giving a low-privilege user a route to capability-gated or data-returning shortcodes and to raw HTML injection on a publicly viewable page. Rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), the impact is bounded by which shortcodes a given site happens to have installed, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Missing authorization in the ProfilePress (wp-user-avatar) WordPress plugin through 4.17.3 allows an authenticated user with only low privileges to perform state-changing actions that should require higher-level capabilities, resulting in unauthorized modification of site data. The flaw is exploitable remotely over the network with low complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base score 6.5), with impact confined to integrity; confidentiality and availability are unaffected per the assessed vector. No public exploit code and no active exploitation have been identified at time of analysis, and exposure is meaningfully reduced on sites that restrict or disable open user registration, since the attacker must first hold a valid low-privilege WordPress account.
ProfilePress versions up to and including 4.17.3 contain a missing authorization vulnerability (CWE-862) that allows unauthenticated remote attackers to bypass incorrectly configured access control checks, potentially leading to unauthorized modification of site data. The flaw requires a specific high-complexity configuration condition (CVSS AC:H) to be exploitable, but when present, it can compromise integrity; confidentiality and availability are unaffected. No public exploit code or active exploitation has been identified at the time of analysis, and the CVSS score is 5.9, reflecting a moderate-severity, high-CVSS-but-tempered-real-risk issue.
Reflected cross-site scripting (XSS) in the ProfilePress WordPress plugin versions up to and including 4.17.4 allows unauthenticated attackers to inject arbitrary web scripts via a crafted POST request with a malicious ppress_billing_address filename, which executes in a victim's browser when they are tricked into clicking a link. Exploitation requires that the affected site hosts the ProfilePress Tabbed Widget; sites not using this widget are not exposed. This moderate-severity flaw (CVSS 6.1) has no public exploit identified at time of analysis and is not confirmed as actively exploited (CISA KEV).
Unauthenticated shortcode injection in the kk Star Ratings - Rate Post & Collect User Feedbacks WordPress plugin (all versions through 5.4.10.3) allows any remote, unauthenticated attacker to execute arbitrary WordPress shortcodes by supplying a crafted payload to the plugin's AJAX handler. The flaw exists because the wp_ajax_kk-star-ratings action passes a user-controlled 'payload' parameter directly to do_shortcode() without allowlisting or sanitizing which shortcode tags are permitted. No public exploit has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog; however, threat intelligence sources tag this as RCE, indicating that practical impact can escalate significantly depending on what shortcodes co-installed plugins register.
Arbitrary shortcode execution in ProfilePress (WordPress plugin) versions through 4.16.19 permits authenticated attackers holding only subscriber-level accounts to inject and run arbitrary WordPress shortcodes within the site context. The plugin's partial mitigation - applying strip_shortcodes() to [profile-first-name] and [profile-last-name] fields - is bypassed via at least three confirmed paths: the [profile-display-name format="first_last_names"] render chain, the [profile-bio] field (which re-fetches raw user_description meta, bypassing the sanitized value), and the double-bracket escape sequence [[tag]] that passes through strip_shortcodes() unmodified but is resolved by the outer do_shortcode() call. No public exploit code has been confirmed at time of analysis, but the low authentication bar (self-registration is the plugin's core use case) and three documented bypass vectors make this a meaningful risk on open-registration membership sites.
Stored Cross-Site Scripting in MailOptin WordPress plugin (versions ≤ 1.2.78.0) allows Contributor-level authenticated users to inject malicious JavaScript payloads that execute in the browser context of higher-privileged users - typically site administrators - when they view the affected content. The CVSS scope change (S:C) confirms the injected script escapes the contributor's own context, making this an effective privilege escalation vector in multi-author WordPress environments. No public exploit code or active exploitation has been identified at time of analysis.
Cross-Site Request Forgery in the CrawlWP SEO WordPress plugin (versions through 3.0.16) allows an unauthenticated attacker to perform unauthorized state-changing actions on behalf of an authenticated site administrator. Exploitation requires social engineering - a logged-in admin must be tricked into visiting a malicious page that silently submits a forged request. The integrity impact is low, limited to unauthorized configuration changes within the plugin's functionality. No public exploit code or active exploitation has been identified at time of analysis, consistent with the vulnerability's low CVSS base score of 4.3.
Cross-site scripting in ProfilePress WordPress plugin versions up to and including 4.16.13 allows authenticated subscribers to inject malicious JavaScript payloads that execute in the browsers of other users - including administrators - who view affected content. The CVSS scope change (S:C) indicator confirms this is a stored or reflected XSS that crosses privilege boundaries, enabling low-privilege users to target higher-privilege accounts. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Missing authorization check in ProfilePress (WordPress membership plugin) versions ≤4.16.12 allows authenticated attackers (Subscriber+) to subscribe to inactive membership plans via a manipulated checkout request. This bypasses plan status enforcement, potentially granting access to restricted content without proper validation. EPSS indicates low exploitation probability, and no active exploitation or public exploit
Arbitrary shortcode execution in ProfilePress plugin for WordPress (all versions up to 4.16.11) allows unauthenticated attackers to execute arbitrary shortcodes by injecting malicious code into billing field values during checkout, potentially leading to information disclosure or content manipulation. The vulnerability stems from insufficient sanitization of user-supplied input before shortcode processing. Wordfence has documented this issue with a CVSS score of 6.5 and no confirmed active exploitation at time of analysis.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Membership Plan. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Drag & Drop Builder. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.13.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.15.18 via the WordPress core search feature. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The ProfilePress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.11.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ProfilePress User Panel widget in all versions up to, and including, 4.15.8 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content -. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in Collins Agbonghama Admin Bar & Dashboard Access Control admin-bar-dashboard-control.2.8. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several form fields in versions up to, and including, 4.5.0 due to insufficient input sanitization and output. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_user_cover_default_image_url’ parameter in versions up to, and including, 4.5.0 due to insufficient. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The User Registration, User Profile, Login & Membership - ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for tabbed login/register was not properly escaped and could. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The User Registration, User Profiles, Login & Membership - ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible for users to escalate their privileges. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.