Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

Information

Software Type Plugin
Software Slug wp-user-avatar (view on wordpress.org)
Software Status Active
Software Author collizo4sky
Software Website profilepress.com
Software Downloads 13,654,373
Software Active Installs 200,000
Software Record Last Updated November 24, 2024

Showing 1-20 of 30 Vulnerabilities

Submit a Vulnerability
ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation
9.8
CVE-2021-34622
Jun 28, 2021
Researcher: Chloe Chamberland
ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload
9.8
CVE-2021-34624
Jun 28, 2021
Researcher: Chloe Chamberland
User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation
9.8
CVE-2021-34621
Jun 28, 2021
Researcher: Chloe Chamberland
User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation
9.8
CVE-2021-34623
Jun 28, 2021
Researcher: Chloe Chamberland
ProfilePress <= 4.13.1 - Limited Privilege Escalation via 'acceptable_defined_roles'
7.3
CVE-2023-41954
Sep 9, 2023
Researcher: Revan Arifio
ProfilePress <= 4.5.3 - Unauthenticated Cross-Site Scripting
7.2
CVE-2022-47444
Mar 27, 2023
Researcher: pilvar
ProfilePress <= 4.5.4 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2023-23830
Feb 21, 2023
Researcher: Rafie Muhammad
Paid Membership, User Registration, User Profile & Restrict Content Plugin – ProfilePress <= 3.1.10 - Unauthenticated Cross-Site Scripting
7.2
CVE-2021-24522
Aug 9, 2021
Researcher: Stiofan
ProfilePress <= 4.3.2 - Authenticated (Admin+) PHP Object Injection
6.6
CVE-2022-45083
Dec 14, 2022
Researcher: Thura Moe Myint (mgthuramoemyint)
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.4 - Unauthenticated Stored Cross-Site Scripting
6.5
CVE-2024-1519
Feb 19, 2024
Researcher: stealthcopter
ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget
6.4
CVE-2024-2861
May 22, 2024
Researcher: wesley (wcraft)
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-2867
Apr 11, 2024
Researcher: Ngô Thiên An (ancorn_)
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'reg-single-checkbox'
6.4
CVE-2024-3210
Apr 9, 2024
Researcher: stealthcopter
ProfilePress <= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2024-1535
Mar 12, 2024
Researcher: Arkadiusz Hydzik
ProfilePress <= 4.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode
6.4
CVE-2024-1806
Feb 23, 2024
Researcher: wesley (wcraft)
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via [reg-select-role] Shortcode
6.4
CVE-2024-1409
Feb 22, 2024
Researcher: Ngô Thiên An (ancorn_)
ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcode
6.4
CVE-2024-1408
Feb 19, 2024
Researcher: Arkadiusz Hydzik
ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2024-1570
Feb 19, 2024
Researcher: Arkadiusz Hydzik
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-1046
Feb 1, 2024
Researcher: Ngô Thiên An (ancorn_)
ProfilePress <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
6.4
CVE-2023-23820
Feb 20, 2023
Researcher: Rafie Muhammad
Title Status CVE ID CVSS Researchers Date
ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation Patched CVE-2021-34622 9.8 Chloe Chamberland June 28, 2021
ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload Patched CVE-2021-34624 9.8 Chloe Chamberland June 28, 2021
User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation Patched CVE-2021-34621 9.8 Chloe Chamberland June 28, 2021
User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation Patched CVE-2021-34623 9.8 Chloe Chamberland June 28, 2021
ProfilePress <= 4.13.1 - Limited Privilege Escalation via 'acceptable_defined_roles' Patched CVE-2023-41954 7.3 Revan Arifio September 9, 2023
ProfilePress <= 4.5.3 - Unauthenticated Cross-Site Scripting Patched CVE-2022-47444 7.2 pilvar March 27, 2023
ProfilePress <= 4.5.4 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2023-23830 7.2 Rafie Muhammad February 21, 2023
Paid Membership, User Registration, User Profile & Restrict Content Plugin – ProfilePress <= 3.1.10 - Unauthenticated Cross-Site Scripting Patched CVE-2021-24522 7.2 Stiofan August 9, 2021
ProfilePress <= 4.3.2 - Authenticated (Admin+) PHP Object Injection Patched CVE-2022-45083 6.6 Thura Moe Myint (mgthuramoemyint) December 14, 2022
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.4 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2024-1519 6.5 stealthcopter February 19, 2024
ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget Patched CVE-2024-2861 6.4 wesley (wcraft) May 22, 2024
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-2867 6.4 Ngô Thiên An (ancorn_) April 11, 2024
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'reg-single-checkbox' Patched CVE-2024-3210 6.4 stealthcopter April 9, 2024
ProfilePress <= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Patched CVE-2024-1535 6.4 Arkadiusz Hydzik March 12, 2024
ProfilePress <= 4.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode Patched CVE-2024-1806 6.4 wesley (wcraft) February 23, 2024
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via [reg-select-role] Shortcode Patched CVE-2024-1409 6.4 Ngô Thiên An (ancorn_) February 22, 2024
ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcode Patched CVE-2024-1408 6.4 Arkadiusz Hydzik February 19, 2024
ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Patched CVE-2024-1570 6.4 Arkadiusz Hydzik February 19, 2024
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-1046 6.4 Ngô Thiên An (ancorn_) February 1, 2024
ProfilePress <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes Patched CVE-2023-23820 6.4 Rafie Muhammad February 20, 2023

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation