SecAlerts
profilepress logo

profilepress

Security Risk Profile

57
/100
medium

Security Risk Score

Comprehensive risk assessment based on 26 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from August 16, 2019 to present

26
Total CVEs
4
Critical+High
0
Exploited
3
Unpatched

Threat Assessment

Avg CVSS
6.4
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
3
Critical/High
Risk Level
57/100
medium
📈 1 in Last 30 Days

Severity Distribution

Critical
0
High
4
Medium
22
Low
0

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
2

Age Distribution

Common Weaknesses (CWE)

1
XSS
18
2
Code Injection
2
3
Malicious File Upload
1
4
Infoleak
1
5
Input Validation
1

Most Affected Products

1. ProfilePress ProfilePress18
2. properfraction Profilepress Wordpress17
3. ProfilePress Loginwp Wordpress3
4. WordPress ProfilePress2
5. ProfilePress User Registration\, Login Form\, User Profile \& Membership Wordpress2

Recent Vulnerabilities

See more →
CVE-2026-13352
CVSS 8.8high

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion

7/17/2026🔧 No Patch
CVE-2026-41556
CVSS 6.5medium

WordPress ProfilePress plugin <= 4.16.13 - Cross Site Scripting (XSS) vulnerability

6/15/2026🔧 No Patch
CVE-2026-3309
CVSS 6.5medium

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields

4/4/2026🔧 No Patch
CVE-2025-8878
CVSS 6.5EPSS 0%medium

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution

8/16/2025🔧 No Patch
CVE-2024-13120
CVSS 4.8medium

ProfilePress < 4.15.20 - Admin+ Stored XSS

2/13/2025🔧 No Patch
CVE-2024-10517
CVSS 4.8medium

ProfilePress < 4.15.15 - Admin+ Stored XSS

12/12/2024🔧 No Patch
CVE-2024-10518
CVSS 4.8medium

ProfilePress < 4.15.15 - Admin+ Stored XSS

12/12/2024🔧 No Patch
CVE-2023-41953
CVSS 5.3medium

WordPress ProfilePress plugin <= 4.13.1 - Broken Access Control vulnerability

12/9/2024
CVE-2023-50882
CVSS 5.3medium

WordPress ProfilePress plugin <= 4.13.2 - Broken Access Control vulnerability

12/9/2024
CVE-2024-11083
CVSS 5.3medium

ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure

11/27/2024

Monitor profilepress in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.