Properfraction vulnerabilities
42 CVEs and advisories name Properfraction as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-119473WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability
- CVE-2026-39733WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability
- CVE-2026-104003Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab
- CVE-2026-109515MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter
- CVE-2026-96337WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability
- CVE-2026-96518WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability
- CVE-2026-92551Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter
- CVE-2026-92536Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields
- CVE-2026-85658Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)
- CVE-2026-3424kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter
- CVE-2026-18385Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field
- CVE-2026-66703WordPress MailOptin plugin <= 1.2.78.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-13352Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion
- CVE-2026-57813WordPress MailOptin plugin <= 1.2.77.3 - Privilege Escalation vulnerability
- CVE-2026-59520WordPress CrawlWP SEO plugin <= 3.0.16 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-41556WordPress ProfilePress plugin <= 4.16.13 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-4949ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription
- CVE-2026-3309Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields
- CVE-2026-3445Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass
- CVE-2026-3453ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration
- CVE-2025-13642ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
- CVE-2025-58596WordPress MailOptin Plugin <= 1.2.75.0 - Cross Site Scripting (XSS) Vulnerability
- CVE-2025-8878Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-11977kk Star Ratings – Rate Post & Collect User Feedbacks <= 5.4.10 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-12309Rate My Post – Star Rating Plugin by FeedbackWP <= 4.2.4 - Unauthenticated Voting On Scheduled Posts
- CVE-2023-50882WordPress ProfilePress plugin <= 4.13.2 - Broken Access Control vulnerability
- CVE-2024-11083ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
- CVE-2022-4974Freemius SDK <= 2.4.2 - Missing Authorization Checks
- CVE-2024-8628Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin <= 1.2.70.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-2861ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget