Log in Start free

properfraction

Products

ProductCVEsExploitedLatest
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress25–Oct 16, 2026
ProfilePress4–Oct 9, 2026
MailOptin3–Aug 6, 2026
kk Star Ratings – Rate Post & Collect User Feedbacks2–Aug 22, 2026
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.2–Oct 16, 2026
Rate My Post – Star Rating Plugin by FeedbackWP1–Dec 13, 2024
CrawlWP SEO – Instant Search Engine Indexing & SEO Performance Monitor1–Feb 5, 2024
CrawlWP SEO1–Jul 5, 2026

Exploited and recent CVEs

  • CVE-2026-104003 Medium 5.4 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab 0.2%
  • CVE-2026-109515 Critical 9.8 MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter 0.4%
  • CVE-2026-96337 Medium 6.5 WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability 0.2%
  • CVE-2026-96518 Medium 5.9 WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability 0.2%
  • CVE-2026-92551 Medium 6.1 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter 0.2%
  • CVE-2026-92536 High 8.8 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields 0.6%
  • CVE-2026-85658 High 8.1 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket) 0.7%
  • CVE-2026-3424 Medium 5.3 kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter 0.5%
  • CVE-2026-18385 Medium 5.4 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field 0.5%
  • CVE-2026-66703 Medium 6.5 WordPress MailOptin plugin <= 1.2.78.0 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-13352 High 8.8 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion 1.1%
  • CVE-2026-57813 Critical 9.8 WordPress MailOptin plugin <= 1.2.77.3 - Privilege Escalation vulnerability 0.5%
  • CVE-2026-59520 Medium 4.3 WordPress CrawlWP SEO plugin <= 3.0.16 - Cross Site Request Forgery (CSRF) vulnerability 0.1%
  • CVE-2026-41556 Medium 6.5 WordPress ProfilePress plugin <= 4.16.13 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-4949 Medium 4.3 ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription 0.3%
  • CVE-2026-3309 Medium 6.5 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields 0.4%
  • CVE-2026-3445 High 7.1 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass 0.2%
  • CVE-2026-3453 High 8.1 ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration 0.4%
  • CVE-2025-13642 Medium 5.4 ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution 0.5%
  • CVE-2025-58596 Medium 5.9 WordPress MailOptin Plugin <= 1.2.75.0 - Cross Site Scripting (XSS) Vulnerability 0.2%
  • CVE-2025-8878 Medium 6.5 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution 0.5%
  • CVE-2024-11977 High 7.3 kk Star Ratings – Rate Post & Collect User Feedbacks <= 5.4.10 - Unauthenticated Arbitrary Shortcode Execution 0.6%
  • CVE-2024-12309 Medium 5.3 Rate My Post – Star Rating Plugin by FeedbackWP <= 4.2.4 - Unauthenticated Voting On Scheduled Posts 0.3%
  • CVE-2023-50882 Medium 5.3 WordPress ProfilePress plugin <= 4.13.2 - Broken Access Control vulnerability 0.5%
  • CVE-2024-11083 Medium 5.3 ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure 0.4%
  • CVE-2024-8628 Medium 5.4 Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin <= 1.2.70.3 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
  • CVE-2024-2861 Medium 6.4 ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget 0.3%
  • CVE-2024-2867 Medium 6.4 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.4 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.4%
  • CVE-2024-3210 Medium 6.4 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'reg-single-checkbox' 0.5%
  • CVE-2024-1806 Medium 6.4 ProfilePress <= 4.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode 0.6%