Known vulnerabilities in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

Setup paid membership, accept payment, sell subscription & digital product, paywall, create login & registration form, user profile & member directory

41Reported vulnerabilities

9.8Highest CVSS score

4.17.1Latest version

100,000+Active installs

What to do now

Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to 4.17.2 or later. 41 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 17, 2026 / Tested up to WordPress: 7.1 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2021-24955	Medium 6.1	1.0%	Before 3.2.3	`3.2.3`	December 13, 2021
CVE-2021-24954	Medium 6.1	1.0%	Before 3.2.3	`3.2.3`	December 13, 2021
CVE-2026-12497	Critical 9.8	0.2%	4.16.17 and earlier	`4.16.18`	July 3, 2026
CVE-2026-66047	Critical 9.2	0.5%	0 up to (but not including) 4.17.2	`4.17.2`	August 31, 2026
CVE-2026-13352	High 8.8	1.1%	0 to 4.16.18 (inclusive)	`4.16.19`	July 17, 2026
CVE-2026-3453	High 8.1	0.4%	0 to 4.16.11 (inclusive)	`4.16.12`	March 11, 2026
CVE-2023-41954	High 7.3	1.4%	Before 4.13.2	`4.13.2`	September 9, 2023
CVE-2022-47444	High 7.2	0.4%	4.5.3 and earlier	`4.5.4`	March 27, 2023
CVE-2023-23830	High 7.2	0.4%	4.5.4 and earlier	`4.5.5`	February 21, 2023
CVE-2026-3445	High 7.1	0.2%	4.16.11 and earlier	`4.16.12`	April 3, 2026
CVE-2022-45083	Medium 6.6	0.6%	4.3.2 and earlier	`4.4.0`	December 14, 2022
CVE-2026-19848	Medium 6.5	0.2%	0 up to (but not including) 4.17.1	`4.17.1`	August 21, 2026
CVE-2026-3309	Medium 6.5	0.4%	4.16.11 and earlier	`4.16.12`	April 3, 2026
CVE-2025-8878	Medium 6.5	0.4%	0 to 4.16.4 (inclusive)	`4.16.5`	August 16, 2025
CVE-2024-2867	Medium 6.4	0.4%	4.15.4 and earlier	`4.15.5`	April 11, 2024
CVE-2024-1409	Medium 6.4	0.4%	4.15.0 and earlier	`4.15.1`	February 22, 2024
CVE-2024-1570	Medium 6.4	0.5%	4.14.4 and earlier	`4.15.0`	February 19, 2024
CVE-2024-1408	Medium 6.4	0.6%	4.14.4 and earlier	`4.15.0`	February 19, 2024
CVE-2023-23820	Medium 6.4	0.4%	4.5.4 and earlier	`4.5.5`	February 20, 2023
CVE-2026-41556	Medium 6.4	0.2%	4.16.13 and earlier	`4.16.14`	April 23, 2026
CVE-2024-1519	Medium 6.1	0.6%	0 to 4.14.4 (inclusive)	`4.15.0`	February 29, 2024
WF-041e635a-9f97-4f54-8ecb-57bbbc321cfc	Medium 6.1	—	Before 4.11.0	`4.11.0`	June 23, 2023
WF-e532a2b4-0fb4-4256-89a9-435b55d9de91	Medium 6.1	—	3.2.15 and earlier	`3.2.16`	July 22, 2022
CVE-2026-18385	Medium 5.4	0.3%	0 to 4.16.19 (inclusive)	`4.17.0`	August 16, 2026
CVE-2025-13642	Medium 5.4	0.5%	0 to 4.16.7 (inclusive)	`4.16.8`	December 9, 2025
CVE-2024-2861	Medium 5.4	0.3%	0 to 4.15.8 (inclusive)	`4.15.9`	May 23, 2024
CVE-2024-3210	Medium 5.4	0.4%	0 to 4.15.5 (inclusive)	`4.15.6`	April 10, 2024
CVE-2024-1806	Medium 5.4	0.6%	0 to 4.15.1 (inclusive)	`4.15.2`	March 13, 2024
CVE-2024-1535	Medium 5.4	0.6%	0 to 4.15.2 (inclusive)	`4.15.3`	March 13, 2024
CVE-2024-1046	Medium 5.4	0.4%	4.14.3 and earlier	`4.14.4`	February 5, 2024
CVE-2023-44150	Medium 5.3	0.7%	4.13.2 and earlier	`4.13.3`	October 2, 2023
CVE-2023-23996	Medium 5.5	0.4%	4.5.3 and earlier	`4.5.4`	January 20, 2023
CVE-2024-11083	Medium 5.3	0.4%	0 to 4.15.18 (inclusive) 0 to 4.15.18 (inclusive)	`4.15.19`	November 27, 2024
CVE-2024-13120	Medium 4.4	0.3%	4.15.19 and earlier	`4.15.20`	January 23, 2025
CVE-2024-13121	Medium 4.4	0.3%	4.15.19 and earlier	`4.15.20`	January 23, 2025
CVE-2024-13119	Medium 4.4	0.4%	4.15.19 and earlier	`4.15.20`	January 23, 2025
CVE-2024-10517	Medium 4.4	0.3%	4.15.14 and earlier	`4.15.15`	November 21, 2024
CVE-2024-10518	Medium 4.4	0.3%	4.15.14 and earlier	`4.15.15`	November 21, 2024
CVE-2026-10820	Medium 4.3	0.4%	4.16.16 and earlier	`4.16.17`	June 6, 2026
CVE-2026-4949	Medium 4.3	0.3%	0 to 4.16.12 (inclusive)	`4.16.13`	April 15, 2026
CVE-2023-41953	Medium 4.3	0.4%	Before 4.13.2	`4.13.2`	September 9, 2023

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.