PR
Vendor
properfraction
73
CVEs
0
On KEV
6
New 30D
Products
PR9.8
ProfilePress
properfraction
37 CVEs0 on KEV2 new
PM8.8
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
properfraction
25 CVEs0 on KEV3 new
MP9.8
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.
properfraction
2 CVEs0 on KEV1 new
MA9.8
MailOptin
properfraction
3 CVEs0 on KEV0 new
KS7.3
kk Star Ratings – Rate Post & Collect User Feedbacks
properfraction
2 CVEs0 on KEV0 new
AB4.8
Admin Bar & Dashboard Access Control
Properfraction
1 CVEs0 on KEV0 new
CS4.3
CrawlWP SEO
properfraction
1 CVEs0 on KEV0 new
CS8.8
CrawlWP SEO – Instant Search Engine Indexing & SEO Performance Monitor
properfraction
1 CVEs0 on KEV0 new
RM5.3
Rate My Post – Star Rating Plugin by FeedbackWP
properfraction
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-104003 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 5.4 | Oct 16 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab |
| CVE-2026-109515 | MP MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. properfraction | 9.8 | Oct 16 | MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter |
| CVE-2026-96337 | PR ProfilePress properfraction | 6.5 | Oct 9 | WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability |
| CVE-2026-96518 | PR ProfilePress properfraction | 5.9 | Oct 9 | WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability |
| CVE-2026-92551 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 6.1 | Oct 3 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter |
| CVE-2026-92536 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 8.8 | Oct 3 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields |
| CVE-2026-85658 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 8.1 | Sep 19 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket) |
| CVE-2026-3424 | KS kk Star Ratings – Rate Post & Collect User Feedbacks properfraction | 5.3 | Aug 22 | kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter |
| CVE-2026-18385 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 5.4 | Aug 16 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field |
| CVE-2026-66703 | MA MailOptin properfraction | 6.5 | Aug 6 | WordPress MailOptin plugin <= 1.2.78.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-13352 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 8.8 | Jul 17 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion |
| CVE-2026-57813 | MA MailOptin properfraction | 9.8 | Jul 13 | WordPress MailOptin plugin <= 1.2.77.3 - Privilege Escalation vulnerability |
| CVE-2026-59520 | CS CrawlWP SEO properfraction | 4.3 | Jul 5 | WordPress CrawlWP SEO plugin <= 3.0.16 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2026-41556 | PR ProfilePress properfraction | 6.5 | Jun 15 | WordPress ProfilePress plugin <= 4.16.13 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-4949 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 4.3 | Apr 15 | ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription |
| CVE-2026-3309 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 6.5 | Apr 4 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields |
| CVE-2026-3445 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 7.1 | Apr 4 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass |
| CVE-2026-3453 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 8.1 | Mar 11 | ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration |
| CVE-2025-13642 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 5.4 | Dec 9 | ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution |
| CVE-2025-58596 | MA MailOptin properfraction | 5.9 | Sep 3 | WordPress MailOptin Plugin <= 1.2.75.0 - Cross Site Scripting (XSS) Vulnerability |
| CVE-2025-8878 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 6.5 | Aug 16 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution |
| CVE-2024-13121 | PR Profilepress Properfraction | 3.5 | Feb 13 | Paid Membership Plugin < 4.15.20 - Admin+ Stored XSS |
| CVE-2024-13120 | PR Profilepress Properfraction | 4.8 | Feb 13 | ProfilePress < 4.15.20 - Admin+ Stored XSS |
| CVE-2024-13119 | PR Profilepress Properfraction | 4.8 | Feb 13 | ProfilePress < 4.15.20 - Admin+ Stored XSS |
| CVE-2024-11977 | KS kk Star Ratings – Rate Post & Collect User Feedbacks properfraction | 7.3 | Dec 21 | kk Star Ratings – Rate Post & Collect User Feedbacks <= 5.4.10 - Unauthenticated Arbitrary Shortcode Execution |
| CVE-2024-12309 | RM Rate My Post – Star Rating Plugin by FeedbackWP properfraction | 5.3 | Dec 13 | Rate My Post – Star Rating Plugin by FeedbackWP <= 4.2.4 - Unauthenticated Voting On Scheduled Posts |
| CVE-2024-10518 | PR Profilepress Properfraction | 4.8 | Dec 12 | ProfilePress < 4.15.15 - Admin+ Stored XSS |
| CVE-2024-10517 | PR Profilepress Properfraction | 4.8 | Dec 12 | ProfilePress < 4.15.15 - Admin+ Stored XSS |
| CVE-2023-41953 | PR Profilepress Properfraction | 5.3 | Dec 9 | WordPress ProfilePress plugin <= 4.13.1 - Broken Access Control vulnerability |
| CVE-2023-50882 | PR ProfilePress properfraction | 5.3 | Dec 9 | WordPress ProfilePress plugin <= 4.13.2 - Broken Access Control vulnerability |
| CVE-2024-11083 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 5.3 | Nov 27 | ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure |
| CVE-2024-9947 | PR Profilepress Properfraction | 9.8 | Oct 23 | ProfilePress - Pro <= 4.11.1 - Authentication Bypass via WordPress.com OAuth provider |
| CVE-2024-8628 | MP MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. properfraction | 5.4 | Sep 24 | Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin <= 1.2.70.3 - Authenticated (Contributor+) Stored Cross-Site Scripting |
| CVE-2024-2861 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 5.4 | May 23 | ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget |
| CVE-2023-41954 | PR Profilepress Properfraction | 8.6 | May 17 | WordPress ProfilePress plugin <= 4.13.1 - Unauthenticated Limited Privilege Escalation vulnerability |
| CVE-2024-2867 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 5.4 | May 2 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.4 - Authenticated (Contributor+) Stored Cross-Site Scripting |
| CVE-2024-3210 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 5.4 | Apr 10 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'reg-single-checkbox' |
| CVE-2024-1806 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 5.4 | Mar 13 | ProfilePress <= 4.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode |
| CVE-2024-1409 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 5.4 | Mar 13 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via [reg-select-role] Shortcode |
| CVE-2024-1535 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 5.4 | Mar 13 | ProfilePress <= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
| CVE-2024-1408 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 5.4 | Feb 20 | ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcode |
| CVE-2024-1519 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 6.1 | Feb 20 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.4 - Unauthenticated Stored Cross-Site Scripting |
| CVE-2024-1570 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 5.4 | Feb 20 | ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
| CVE-2024-0428 | CS CrawlWP SEO – Instant Search Engine Indexing & SEO Performance Monitor properfraction | 8.8 | Feb 5 | Index Now <= 2.6.3 - Cross-Site Request Forgery via reset_form |
| CVE-2024-1046 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 5.4 | Feb 5 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting |
| CVE-2022-45083 | PR Profilepress Properfraction | 7.2 | Jan 19 | WordPress ProfilePress Plugin <= 4.3.2 is vulnerable to PHP Object Injection |
| CVE-2023-44150 | PR Profilepress Properfraction | 7.5 | Nov 30 | WordPress ProfilePress Plugin <= 4.13.2 is vulnerable to Sensitive Data Exposure |
| CVE-2023-47184 | AB Admin Bar & Dashboard Access Control Properfraction | 4.8 | Nov 6 | WordPress Admin Bar & Dashboard Access Control Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS) |
| CVE-2023-23830 | PR Profilepress Properfraction | 6.1 | May 3 | WordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS) |
| CVE-2023-23820 | PR Profilepress Properfraction | 5.4 | May 3 | WordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS) |
| CVE-2023-23996 | PR Profilepress Properfraction | 4.8 | Apr 6 | WordPress ProfilePress Plugin <= 4.5.3 is vulnerable to Cross Site Scripting (XSS) |
| CVE-2022-47444 | PR Profilepress Properfraction | 6.1 | Mar 29 | WordPress ProfilePress Plugin <= 4.4.1 is vulnerable to Cross Site Scripting (XSS) |
| CVE-2022-4697 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 4.8 | Dec 23 | ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting |
| CVE-2022-4698 | PM Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress properfraction | 4.8 | Dec 23 | ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form Settings |
| CVE-2021-24522 | PR Profilepress Properfraction | 6.1 | Aug 9 | ProfilePress < 3.1.11 - Unauthenticated Cross-Site Scripting (XSS) in tabbed login/register widget |
| CVE-2021-24450 | PR Profilepress Properfraction | 4.8 | Aug 2 | ProfilePress < 3.1.8 - Authenticated Stored XSS |
| CVE-2021-34624 | PR Profilepress Properfraction | 9.8 | Jul 7 | ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in File Uploader Component |
| CVE-2021-34621 | PR Profilepress Properfraction | 9.8 | Jul 7 | ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation |
| CVE-2021-34623 | PR Profilepress Properfraction | 9.8 | Jul 7 | ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in Image Uploader Component |
| CVE-2021-34622 | PR Profilepress Properfraction | 8.8 | Jul 7 | ProfilePress 3.0 - 3.1.3 - Authenticated Privilege Escalation |