properfraction vulnerabilities

CVEs per yearBy the year they were published

1. 20222
2. 202417
3. 20253
4. 202618

Newest CVEs

• CVE-2026-104003

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab

  properfraction · Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

  Medium5.4
• CVE-2026-109515

  MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter

  properfraction · MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.

  Critical9.8
• CVE-2026-96337

  WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability

  properfraction · ProfilePress

  Medium6.5
• CVE-2026-96518

  WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability

  properfraction · ProfilePress

  Medium5.9
• CVE-2026-92551

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter

  properfraction · Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

  Medium6.1
• CVE-2026-92536

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields

  properfraction · Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

  High8.8
• CVE-2026-85658

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)

  properfraction · Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

  High8.1
• CVE-2026-3424

  kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter

  properfraction · kk Star Ratings – Rate Post & Collect User Feedbacks

  Medium5.3
• CVE-2026-18385

  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field

  properfraction · Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

  Medium5.4
• CVE-2026-66703

  WordPress MailOptin plugin <= 1.2.78.0 - Cross Site Scripting (XSS) vulnerability

  properfraction · MailOptin

  Medium6.5