VendorsProper Fractionprofilepressany version
Vulnerabilities

Proper Fraction ProfilePress any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

34CVEs
CVE-2021-34621
ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation
Published 2021-07-07 · Modified
9.81 PoCEPSS 0.689
CVE-2021-34624
ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in File Uploader Component
Published 2021-07-07 · Modified
9.8EPSS 0.067
CVE-2021-34622
ProfilePress 3.0 - 3.1.3 - Authenticated Privilege Escalation
Published 2021-07-07 · Modified
9.8EPSS 0.041
CVE-2021-34623
ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in Image Uploader Component
Published 2021-07-07 · Modified
9.8EPSS 0.021
CVE-2024-9947
ProfilePress - Pro <= 4.11.1 - Authentication Bypass via WordPress.com OAuth provider
Published 2024-10-23 · Analyzed
9.8EPSS 0.005
CVE-2023-41954
WordPress ProfilePress plugin <= 4.13.1 - Unauthenticated Limited Privilege Escalation vulnerability
Published 2024-05-17 · Analyzed
8.6EPSS 0.012
CVE-2023-44150
WordPress ProfilePress Plugin <= 4.13.2 is vulnerable to Sensitive Data Exposure
Published 2023-11-30 · Modified
7.5EPSS 0.007
CVE-2022-45083
WordPress ProfilePress Plugin <= 4.3.2 is vulnerable to PHP Object Injection
Published 2024-01-19 · Modified
7.2EPSS 0.006
CVE-2023-23830
WordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS)
Published 2023-05-03 · Modified
7.1EPSS 0.004
CVE-2022-47444
WordPress ProfilePress Plugin <= 4.4.1 is vulnerable to Cross Site Scripting (XSS)
Published 2023-03-29 · Modified
7.1EPSS 0.004
CVE-2024-1519
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.4 - Unauthenticated Stored Cross-Site Scripting
Published 2024-02-20 · Modified
6.5EPSS 0.006
CVE-2023-23820
WordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS)
Published 2023-05-03 · Modified
6.5EPSS 0.004
CVE-2024-1408
ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcode
Published 2024-02-20 · Modified
6.4EPSS 0.006
CVE-2024-1535
ProfilePress <= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published 2024-03-13 · Modified
6.4EPSS 0.006
CVE-2024-1806
ProfilePress <= 4.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode
Published 2024-03-13 · Modified
6.4EPSS 0.006
CVE-2024-1570
ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published 2024-02-20 · Modified
6.4EPSS 0.005
CVE-2024-1409
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via [reg-select-role] Shortcode
Published 2024-03-13 · Modified
6.4EPSS 0.004
CVE-2024-3210
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'reg-single-checkbox'
Published 2024-04-10 · Modified
6.4EPSS 0.004
CVE-2024-2867
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published 2024-05-02 · Modified
6.4EPSS 0.004
CVE-2024-1046
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published 2024-02-05 · Modified
6.4EPSS 0.004
CVE-2024-2861
ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget
Published 2024-05-23 · Modified
6.4EPSS 0.003
CVE-2021-24522
ProfilePress < 3.1.11 - Unauthenticated Cross-Site Scripting (XSS) in tabbed login/register widget
Published 2021-08-09 · Modified
6.1EPSS 0.016
CVE-2023-23996
WordPress ProfilePress Plugin <= 4.5.3 is vulnerable to Cross Site Scripting (XSS)
Published 2023-04-06 · Modified
5.9EPSS 0.004
CVE-2022-4697
ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published 2022-12-23 · Modified
5.5EPSS 0.007
CVE-2022-4698
ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form Settings
Published 2022-12-23 · Modified
5.5EPSS 0.006
CVE-2023-50882
WordPress ProfilePress plugin <= 4.13.2 - Broken Access Control vulnerability
Published 2024-12-09 · Modified
5.3EPSS 0.005
CVE-2023-41953
WordPress ProfilePress plugin <= 4.13.1 - Broken Access Control vulnerability
Published 2024-12-09 · Analyzed
5.3EPSS 0.004
CVE-2024-11083
ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
Published 2024-11-27 · Analyzed
5.3EPSS 0.004
CVE-2021-24450
ProfilePress < 3.1.8 - Authenticated Stored XSS
Published 2021-08-02 · Modified
4.8EPSS 0.007
CVE-2024-13119
ProfilePress < 4.15.20 - Admin+ Stored XSS
Published 2025-02-13 · Analyzed
4.8EPSS 0.004
CVE-2024-10518
ProfilePress < 4.15.15 - Admin+ Stored XSS
Published 2024-12-12 · Analyzed
4.8EPSS 0.004
CVE-2024-10517
ProfilePress < 4.15.15 - Admin+ Stored XSS
Published 2024-12-12 · Analyzed
4.8EPSS 0.004
CVE-2024-13120
ProfilePress < 4.15.20 - Admin+ Stored XSS
Published 2025-02-13 · Analyzed
4.8EPSS 0.003
CVE-2024-13121
Paid Membership Plugin < 4.15.20 - Admin+ Stored XSS
Published 2025-02-13 · Analyzed
3.5EPSS 0.003