Skip to content
Threat Feed
Subscribe

Vendor

ProfilePress

4 briefs RSS
high advisory

Sensitive Information Exposure in ProfilePress Plugin

The ProfilePress plugin for WordPress (<= 4.17.4) is vulnerable to sensitive information exposure, allowing authenticated and unauthenticated attackers to extract user PII via crafted shortcode parameters.

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress web-application-vulnerability wordpress cve
2t 1c
high advisory

Arbitrary Shortcode Execution in ProfilePress Plugin

The ProfilePress WordPress plugin is vulnerable to arbitrary shortcode execution in versions up to 4.17.2, allowing authenticated users with subscriber-level access to execute arbitrary shortcodes.

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content wordpress vulnerability rce
2t 1c
high advisory

Unauthenticated Remote Code Execution in ProfilePress WordPress Plugin

The ProfilePress WordPress plugin contains an unauthenticated RCE vulnerability (CVE-2026-66047) caused by a predictable 32-bit connect token in the AJAX handler, allowing remote attackers to install malicious plugins.

ProfilePress
1r 2t 1c
high advisory

Arbitrary File Upload Vulnerability in ProfilePress WordPress Plugin (CVE-2026-13352)

An arbitrary file upload vulnerability, CVE-2026-13352, affects the ProfilePress plugin for WordPress up to version 4.16.18, allowing authenticated attackers with author-level privileges or higher to upload executable files, which can lead to remote code execution.

ProfilePress plugin for WordPress wordpress vulnerability rce file-upload cms
3t 1c