Vendor

    ProfilePress Membership Team

    61 known vulnerabilities in products by ProfilePress Membership Team, 0 of them actively exploited (CISA KEV).

    Key figures

    61

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    7

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in ProfilePress Membership Team
    CriticalCVE-2021-34621

    ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation

    also in 1 other product

    		9.8
    CriticalCVE-2021-34624

    ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in File Uploader Component

    also in 1 other product

    		9.8
    CriticalCVE-2021-34622

    ProfilePress 3.0 - 3.1.3 - Authenticated Privilege Escalation

    also in 1 other product

    		9.8
    CriticalCVE-2021-34623

    ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in Image Uploader Component

    also in 1 other product

    		9.8
    HighCVE-2026-13352

    Unrestricted Upload of File with Dangerous Type (CVE-2026-13352)

    		8.8
    HighCVE-2026-92536

    Code Injection (CVE-2026-92536)

    		8.8
    CriticalCVE-2026-109515

    Improper Privilege Management (CVE-2026-109515)

    		9.8
    HighCVE-2023-41954

    WordPress ProfilePress plugin <= 4.13.1 - Unauthenticated Limited Privilege Escalation vulnerability

    also in 1 other product

    		8.6
    HighCVE-2026-85658

    Code Injection (CVE-2026-85658)

    		8.1
    CriticalCVE-2026-57813

    WordPress MailOptin plugin <= 1.2.77.3 - Privilege Escalation vulnerability

    		9.8
    MediumCVE-2021-24522

    ProfilePress < 3.1.11 - Unauthenticated Cross-Site Scripting (XSS) in tabbed login/register widget

    		6.1
    HighCVE-2023-44150

    WordPress ProfilePress Plugin <= 4.13.2 is vulnerable to Sensitive Data Exposure

    also in 1 other product

    		7.5
    MediumCVE-2026-3424

    kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter

    		5.3
    MediumCVE-2026-18385

    Code Injection (CVE-2026-18385)

    		5.4
    HighCVE-2026-3453

    Authorization Bypass Through User-Controlled Key (CVE-2026-3453)

    		8.1
    HighCVE-2024-11977

    ProfilePress Membership Team kk Star Ratings: Code Injection

    		7.3
    CriticalCVE-2024-9947

    ProfilePress - Pro <= 4.11.1 - Authentication Bypass via WordPress.com OAuth provider

    		8.1
    MediumCVE-2026-96337

    WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability

    		6.5
    MediumCVE-2026-92551

    Cross-site Scripting (CVE-2026-92551)

    		6.1
    MediumCVE-2026-96518

    WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability

    		5.9
    MediumCVE-2026-104003

    Code Injection (CVE-2026-104003)

    		5.4
    MediumCVE-2026-3309

    Code Injection (CVE-2026-3309)

    		6.5
    HighCVE-2022-45083

    WordPress ProfilePress Plugin <= 4.3.2 is vulnerable to PHP Object Injection

    also in 1 other product

    		6.6
    MediumCVE-2026-66703

    WordPress MailOptin plugin <= 1.2.78.0 - Cross Site Scripting (XSS) vulnerability

    		6.5
    MediumCVE-2024-1408

    ProfilePress: Cross-site Scripting

    		6.4

    All vulnerabilities in search

    Products

    Products by ProfilePress Membership Team
    ProfilePress370
    Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – Profilepress250
    Kk Star Ratings – Rate Post & Collect User Feedbacks30
    MailOptin30