WordPress plugin · wp-user-avatar
Is Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content safe?
Safe on 4.17.7 or newer.
The current version, 4.17.7, is past every affected range on record (52 of 52 records list one). Keep it updated and you’re clear of them.
- Flaws on record
- 52
- High or critical
- 16
- Exploited
- none
- Current version
- 4.17.7
- Last updated
- Oct 15, 2026
- Active installs
- 100,000+
Every recorded flaw
- Oct 16, 2026WP User Avatar / ProfilePress: Arbitrary Shortcode ExecutionCVE-2026-104003 · affects up to 4.17.5 · reported by WordfenceMedium 5.4
- Oct 9, 2026ProfilePress: Missing AuthorizationCVE-2026-96518 · affects up to 4.17.3 · reported by PatchstackMedium 5.9
- Oct 9, 2026ProfilePress: Missing AuthorizationCVE-2026-96337 · affects up to 4.17.3 · reported by PatchstackMedium 6.5
- Oct 3, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Reflected Cross-Site ScriptingCVE-2026-92551 · affects up to 4.17.4 · reported by WordfenceMedium 6.1
- Oct 3, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Sensitive Information ExposureCVE-2026-92536 · affects up to 4.17.4 · reported by WordfenceHigh 8.8
- Sep 19, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Arbitrary shortcode executionCVE-2026-85658 · affects up to 4.17.2 · reported by WordfenceHigh 8.1
- Aug 31, 2026ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackeCVE-2026-66047 · fixed in 4.17.2 · reported by VulnCheckCritical 9.2
- Aug 21, 2026ProfilePress: Does not strip shortcodes from two of its profile fields before rendering them on public pagesCVE-2026-19848 · fixed in 4.17.1 · reported by WPScanMedium 6.5
- Aug 16, 2026The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerableCVE-2026-18385 · affects up to 4.16.19 · reported by WordfenceMedium 5.4
- Jul 24, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not consistently enforce the role restriction configured on its front-end registration role-selection fieldCVE-2026-12497 · fixed in 4.16.18 · reported by WPScanHigh 7.5
- Jul 17, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Arbitrary File UploadCVE-2026-13352 · affects up to 4.16.18 · reported by Wordfence1.1% oddsHigh 8.8
- Jun 27, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not verify that the user performing a subscription action owns the targeted subscriptionCVE-2026-10820 · fixed in 4.16.17 · reported by WPScanHigh 8.1
- Jun 15, 2026Subscriber Cross Site Scripting (XSS) in ProfilePress <= 4.16.13 versions.CVE-2026-41556 · affects up to 4.16.13 · reported by PatchstackMedium 6.5
- Apr 15, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Missing AuthorizationCVE-2026-4949 · affects up to 4.16.12 · reported by WordfenceMedium 4.3
- Apr 4, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Arbitrary shortcode executionCVE-2026-3309 · affects up to 4.16.11 · reported by WordfenceMedium 6.5
- Apr 4, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Unauthorized membership payment bypassCVE-2026-3445 · affects up to 4.16.11 · reported by WordfenceHigh 7.1
- Mar 10, 2026ProfilePress: Insecure Direct Object ReferenceCVE-2026-3453 · affects up to 4.16.11 · reported by WordfenceHigh 8.1
- Dec 9, 2025Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Arbitrary shortcode executionCVE-2025-13642 · affects up to 4.16.7 · reported by WordfenceMedium 5.4
- Aug 16, 2025The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerableCVE-2025-8878 · affects up to 4.16.4 · reported by WordfenceMedium 6.5
- Feb 13, 2025Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not sanitise and escape some of its settingsCVE-2024-13121 · fixed in 4.15.20 · reported by WPScanLow 3.5
- Feb 13, 2025Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not sanitise and escape some of its settingsCVE-2024-13120 · fixed in 4.15.20 · reported by WPScanMedium 4.8
- Feb 13, 2025Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not sanitise and escape some of its settingsCVE-2024-13119 · fixed in 4.15.20 · reported by WPScanMedium 4.8
- Dec 12, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not sanitise and escape some of its Membership Plan settingsCVE-2024-10518 · fixed in 4.15.15 · reported by WPScanMedium 4.8
- Dec 12, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not sanitise and escape some of its Drag & Drop Builder fieldsCVE-2024-10517 · fixed in 4.15.15 · reported by WPScanMedium 4.8
- Dec 9, 2024ProfilePress: Missing AuthorizationCVE-2023-41953 · affects up to 4.13.1 · reported by PatchstackMedium 5.3
- Dec 9, 2024ProfilePress: Missing AuthorizationCVE-2023-50882 · affects up to 4.13.2 · reported by PatchstackMedium 5.3
- Nov 27, 2024ProfilePress: Sensitive Information ExposureCVE-2024-11083 · affects up to 4.15.18 · reported by WordfenceMedium 5.3
- May 23, 2024ProfilePress: Stored Cross-Site ScriptingCVE-2024-2861 · affects up to 4.15.8 · reported by WordfenceMedium 6.4
- May 17, 2024ProfilePress: Improper Privilege ManagementCVE-2023-41954 · affects up to 4.13.1 · reported by Patchstack1.4% oddsHigh 8.6
- May 2, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Stored Cross-Site ScriptingCVE-2024-2867 · affects up to 4.15.4 · reported by WordfenceMedium 6.4
- Apr 10, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Stored Cross-Site ScriptingCVE-2024-3210 · affects up to 4.15.5 · reported by WordfenceMedium 6.4
- Mar 13, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Stored Cross-Site ScriptingCVE-2024-1806 · affects up to 4.15.1 · reported by WordfenceMedium 6.4
- Mar 13, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Stored Cross-Site ScriptingCVE-2024-1535 · affects up to 4.15.2 · reported by WordfenceMedium 6.4
- Mar 13, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Stored Cross-Site ScriptingCVE-2024-1409 · affects up to 4.15.0 · reported by WordfenceMedium 6.4
- Feb 28, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Stored Cross-Site ScriptingCVE-2024-1570 · affects up to 4.14.4 · reported by WordfenceMedium 6.4
- Feb 28, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Stored Cross-Site ScriptingCVE-2024-1519 · affects up to 4.14.4 · reported by WordfenceMedium 6.5
- Feb 28, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Stored Cross-Site ScriptingCVE-2024-1408 · affects up to 4.14.4 · reported by WordfenceMedium 6.4
- Feb 5, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Stored Cross-Site ScriptingCVE-2024-1046 · affects up to 4.14.3 · reported by WordfenceMedium 6.4
- Jan 19, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Deserialization of Untrusted DataCVE-2022-45083 · affects up to 4.3.2 · reported by PatchstackMedium 6.6
- Nov 30, 2023Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-44150 · affects up to 4.13.2 · reported by PatchstackHigh 7.5
- May 3, 2023Unauth.CVE-2023-23830 · fixed in 4.5.5 · reported by PatchstackHigh 7.1
- May 3, 2023Auth.CVE-2023-23820 · fixed in 4.5.5 · reported by PatchstackMedium 6.5
- Apr 6, 2023Auth.CVE-2023-23996 · fixed in 4.5.4 · reported by PatchstackMedium 5.9
- Mar 29, 2023Unauth.CVE-2022-47444 · affects up to 4.5.3 · reported by PatchstackHigh 7.1
- Dec 23, 2022ProfilePress: Stored Cross-Site ScriptingCVE-2022-4698 · affects up to 4.5.0 · reported by WordfenceMedium 5.5
- Dec 23, 2022ProfilePress: Stored Cross-Site ScriptingCVE-2022-4697 · affects up to 4.5.0 · reported by WordfenceMedium 5.5
- Dec 13, 2021User Registration, Login Form, User Profile & Membership: Does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attributeCVE-2021-24955 · fixed in 3.2.3 · reported by WPScan1.0% oddsMedium 6.1
- Dec 13, 2021User Registration, Login Form, User Profile & Membership: Does not sanitise and escape the ppress_cc_data parameter before outputting it back in an attribute of an admin dashboard pageCVE-2021-24954 · fixed in 3.2.3 · reported by WPScan1.0% oddsMedium 6.1
- Jul 7, 2021A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users CVE-2021-34624 · affects 3.0.0 to 3.1.3 · reported by Wordfence8.1% oddsCritical 9.8
- Jul 7, 2021A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for userCVE-2021-34623 · affects 3.0.0 to 3.1.3 · reported by Wordfence2.1% oddsCritical 9.8
- Jul 7, 2021A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible fCVE-2021-34622 · affects 3.0.0 to 3.1.3 · reported by Wordfence4.1% oddsCritical 9.8
- Jul 7, 2021A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible foCVE-2021-34621 · affects 3.0.0 to 3.1.3 · reported by Wordfence69% oddsCritical 9.8
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.