# cve.now: Properfraction

The newest entries naming Properfraction as an affected vendor (up to 200), of 42 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-119473](https://cve.now/CVE-2026-119473.md): WordPress ProfilePress plugin \<= 4.17.7 - Content Injection vulnerability (CVSS 4.3)
- [CVE-2026-39733](https://cve.now/CVE-2026-39733.md): WordPress ProfilePress plugin \<= 4.17.7 - Content Injection vulnerability (CVSS 5.3)
- [CVE-2026-104003](https://cve.now/CVE-2026-104003.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \<= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab (CVSS 5.4)
- [CVE-2026-109515](https://cve.now/CVE-2026-109515.md): MailOptin \<= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form\_custom\_field\_mappings' Parameter (CVSS 9.8)
- [CVE-2026-96337](https://cve.now/CVE-2026-96337.md): WordPress ProfilePress plugin \<= 4.17.3 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-96518](https://cve.now/CVE-2026-96518.md): WordPress ProfilePress plugin \<= 4.17.3 - Broken Access Control vulnerability (CVSS 5.9)
- [CVE-2026-92551](https://cve.now/CVE-2026-92551.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \<= 4.17.4 - Reflected Cross-Site Scripting via ppress\_billing\_address Filename Parameter (CVSS 6.1)
- [CVE-2026-92536](https://cve.now/CVE-2026-92536.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \<= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields (CVSS 8.8)
- [CVE-2026-85658](https://cve.now/CVE-2026-85658.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \<= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup\_bio' Biography Field (Entity-Encoded Shortcode Bracket) (CVSS 8.1)
- [CVE-2026-3424](https://cve.now/CVE-2026-3424.md): kk Star Ratings \<= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter (CVSS 5.3)
- [CVE-2026-18385](https://cve.now/CVE-2026-18385.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \<= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field (CVSS 5.4)
- [CVE-2026-66703](https://cve.now/CVE-2026-66703.md): WordPress MailOptin plugin \<= 1.2.78.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-13352](https://cve.now/CVE-2026-13352.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \<= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload\_mimes Filter Expansion (CVSS 8.8)
- [CVE-2026-57813](https://cve.now/CVE-2026-57813.md): WordPress MailOptin plugin \<= 1.2.77.3 - Privilege Escalation vulnerability (CVSS 9.8)
- [CVE-2026-59520](https://cve.now/CVE-2026-59520.md): WordPress CrawlWP SEO plugin \<= 3.0.16 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2026-41556](https://cve.now/CVE-2026-41556.md): WordPress ProfilePress plugin \<= 4.16.13 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-4949](https://cve.now/CVE-2026-4949.md): ProfilePress \<= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription (CVSS 4.3)
- [CVE-2026-3309](https://cve.now/CVE-2026-3309.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress \<= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields (CVSS 6.5)
- [CVE-2026-3445](https://cve.now/CVE-2026-3445.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress \<= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass (CVSS 7.1)
- [CVE-2026-3453](https://cve.now/CVE-2026-3453.md): ProfilePress \<= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration (CVSS 8.1)
- [CVE-2025-13642](https://cve.now/CVE-2025-13642.md): ProfilePress \<= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution (CVSS 5.4)
- [CVE-2025-58596](https://cve.now/CVE-2025-58596.md): WordPress MailOptin Plugin \<= 1.2.75.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9)
- [CVE-2025-8878](https://cve.now/CVE-2025-8878.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress \<= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution (CVSS 6.5)
- [CVE-2024-11977](https://cve.now/CVE-2024-11977.md): kk Star Ratings – Rate Post & Collect User Feedbacks \<= 5.4.10 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3)
- [CVE-2024-12309](https://cve.now/CVE-2024-12309.md): Rate My Post – Star Rating Plugin by FeedbackWP \<= 4.2.4 - Unauthenticated Voting On Scheduled Posts (CVSS 5.3)
- [CVE-2023-50882](https://cve.now/CVE-2023-50882.md): WordPress ProfilePress plugin \<= 4.13.2 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-11083](https://cve.now/CVE-2024-11083.md): ProfilePress \<= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (CVSS 5.3)
- [CVE-2022-4974](https://cve.now/CVE-2022-4974.md): Freemius SDK \<= 2.4.2 - Missing Authorization Checks (CVSS 6.3)
- [CVE-2024-8628](https://cve.now/CVE-2024-8628.md): Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin \<= 1.2.70.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
- [CVE-2024-2861](https://cve.now/CVE-2024-2861.md): ProfilePress \<= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget (CVSS 6.4)
- [CVE-2024-2867](https://cve.now/CVE-2024-2867.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress \<= 4.15.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-3210](https://cve.now/CVE-2024-3210.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress \<= 4.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'reg-single-checkbox' (CVSS 6.4)
- [CVE-2024-1806](https://cve.now/CVE-2024-1806.md): ProfilePress \<= 4.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode (CVSS 6.4)
- [CVE-2024-1409](https://cve.now/CVE-2024-1409.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress \<= 4.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via \[reg-select-role\] Shortcode (CVSS 6.4)
- [CVE-2024-1535](https://cve.now/CVE-2024-1535.md): ProfilePress \<= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2024-1408](https://cve.now/CVE-2024-1408.md): ProfilePress \<= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via \[edit-profile-text-box\] shortcode (CVSS 6.4)
- [CVE-2024-1519](https://cve.now/CVE-2024-1519.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress \<= 4.14.4 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.5)
- [CVE-2024-1570](https://cve.now/CVE-2024-1570.md): ProfilePress \<= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2024-0428](https://cve.now/CVE-2024-0428.md): Index Now \<= 2.6.3 - Cross-Site Request Forgery via reset\_form (CVSS 7.1)
- [CVE-2024-1046](https://cve.now/CVE-2024-1046.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress \<= 4.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2022-4697](https://cve.now/CVE-2022-4697.md): ProfilePress \<= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5)
- [CVE-2022-4698](https://cve.now/CVE-2022-4698.md): ProfilePress \<= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form Settings (CVSS 5.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/properfraction
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.