# ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content

> Paid membership & LMS plugin. Sell courses, subscriptions & digital products, paywall content, and add login & registration forms and user profiles.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-06 04:23 UTC.

## Facts (WordPress.org)

- Slug: `wp-user-avatar`
- Author: properfraction
- Version: 4.18.0
- Active installs: 100,000+
- Last update: 2026-10-31 (6 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.9, PHP 8.0
- Tags: course, ecommerce, lms, membership, User Registration
- Page: https://wordpress.org/plugins/wp-user-avatar/

## Checks (against WordPress 7.1.4)

- OK: Updated 6 days ago.
- OK: Tested with WordPress 7.1.
- FLAG: Requires PHP 8.0 or newer, above WordPress's own minimum (PHP 7.4).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Leaky ↔ Spam-proof, Breaking ↔ Smooth, Clashes ↔ Plays well, Locked in ↔ Portable, Inaccessible ↔ Accessible, Slow ↔ Responsive.

## Known vulnerabilities

- 2026-10-16 MEDIUM: Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab (up to 4.17.5). CVE-2026-104003, https://www.wordfence.com/threat-intel/vulnerabilities/id/83adfbff-f625-4474-81b9-961c496d59a0?source=api-prod
- 2026-10-09 MEDIUM: Missing Authorization (up to 4.17.3). CVE-2026-96337, https://www.wordfence.com/threat-intel/vulnerabilities/id/0513cd66-604c-428d-a19d-e41bb3b1a74d?source=api-prod
- 2026-10-09 MEDIUM: Missing Authorization (up to 4.17.3). CVE-2026-96518, https://www.wordfence.com/threat-intel/vulnerabilities/id/e48ab98a-7fbd-4199-821c-e8634175689a?source=api-prod
- 2026-10-03 HIGH: Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields (up to 4.17.4). CVE-2026-92536, https://www.wordfence.com/threat-intel/vulnerabilities/id/1340aeb3-12a0-4965-95db-45d753935812?source=api-prod
- 2026-10-03 MEDIUM: Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter (up to 4.17.4). CVE-2026-92551, https://www.wordfence.com/threat-intel/vulnerabilities/id/269dd459-c857-49ed-b5d6-8c9e946ac590?source=api-prod
- 2026-09-19 HIGH: Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket) (up to 4.17.2). CVE-2026-85658, https://www.wordfence.com/threat-intel/vulnerabilities/id/b8486d1d-8a76-446e-867b-8db32499ebf8?source=api-prod
- 2026-08-31 HIGH: Unauthenticated Arbitrary Plugin Installation via Brute Force (up to 4.17.1). CVE-2026-66047, https://www.wordfence.com/threat-intel/vulnerabilities/id/4127aeb5-f077-4040-b6ad-55dbf2643077?source=api-prod
- 2026-08-21 HIGH: Unauthenticated Arbitrary Shortcode Execution (before 4.17.1). CVE-2026-19848, https://www.wordfence.com/threat-intel/vulnerabilities/id/154d2fc1-15da-4e0d-a5fc-a5d708fad410?source=api-prod
- 2026-08-16 MEDIUM: Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field (up to 4.16.19). CVE-2026-18385, https://www.wordfence.com/threat-intel/vulnerabilities/id/345f3354-d2cb-4b92-a25d-9551a5992919?source=api-prod
- 2026-07-24 CRITICAL: Unauthenticated Privilege Escalation (up to 4.16.17). CVE-2026-12497, https://www.wordfence.com/threat-intel/vulnerabilities/id/f53f35c4-6825-448f-a101-1439fdd63cfe?source=api-prod
- 2026-07-17 HIGH: Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion (up to 4.16.18). CVE-2026-13352, https://www.wordfence.com/threat-intel/vulnerabilities/id/9bb520df-e838-4335-bd4f-97026082a204?source=api-prod
- 2026-06-27 MEDIUM: Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation (up to 4.16.16). CVE-2026-10820, https://www.wordfence.com/threat-intel/vulnerabilities/id/6480715e-efb7-4dd2-8938-c5b662d86461?source=api-prod
- 2026-06-15 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 4.16.13). CVE-2026-41556, https://www.wordfence.com/threat-intel/vulnerabilities/id/d0bd67c9-4c5a-41f0-971f-19e6525092ca?source=api-prod
- 2026-04-15 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription (up to 4.16.12). CVE-2026-4949, https://www.wordfence.com/threat-intel/vulnerabilities/id/4cc29d32-2727-42df-bd42-2caf0f182c0e?source=api-prod
- 2026-04-03 MEDIUM: Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields (up to 4.16.11). CVE-2026-3309, https://www.wordfence.com/threat-intel/vulnerabilities/id/3f8f083e-0de2-42a5-b289-101ec53aa44c?source=api-prod
- 2026-04-03 HIGH: Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass (up to 4.16.11). CVE-2026-3445, https://www.wordfence.com/threat-intel/vulnerabilities/id/ae1e198b-0c0d-47aa-8a56-ec4e790c8022?source=api-prod
- 2026-03-10 HIGH: Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration (up to 4.16.11). CVE-2026-3453, https://www.wordfence.com/threat-intel/vulnerabilities/id/74e4808f-bd6f-4e62-91cb-31c86a427498?source=api-prod
- 2025-12-08 MEDIUM: Authenticated (Subscriber+) Arbitrary Shortcode Execution (up to 4.16.7). CVE-2025-13642, https://www.wordfence.com/threat-intel/vulnerabilities/id/4736d139-814e-4eeb-91e8-5ee41fc35a8f?source=api-prod
- 2025-08-15 MEDIUM: Unauthenticated Arbitrary Shortcode Execution (up to 4.16.4). CVE-2025-8878, https://www.wordfence.com/threat-intel/vulnerabilities/id/9309b8bf-f581-4a56-a1ed-3941ebb36127?source=api-prod
- 2025-01-23 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 4.15.19). CVE-2024-13120, https://www.wordfence.com/threat-intel/vulnerabilities/id/a2f378dd-d8de-445e-9c54-d07627e9c0e9?source=api-prod
- 2025-01-23 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 4.15.19). CVE-2024-13121, https://www.wordfence.com/threat-intel/vulnerabilities/id/d00c6fe3-5914-46e1-9a00-0641d17aa79f?source=api-prod
- 2025-01-23 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 4.15.19). CVE-2024-13119, https://www.wordfence.com/threat-intel/vulnerabilities/id/f22e9f6c-243f-4df0-bb59-57e0ad6a1f69?source=api-prod
- 2024-11-26 MEDIUM: Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (up to 4.15.18). CVE-2024-11083, https://www.wordfence.com/threat-intel/vulnerabilities/id/60c8159f-0641-4b75-9d56-34bd13105caf?source=api-prod
- 2024-11-21 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting via "Labels" (up to 4.15.14). CVE-2024-10517, https://www.wordfence.com/threat-intel/vulnerabilities/id/91291608-5aa4-4fa1-b0d8-2b94d3d46f9c?source=api-prod
- 2024-11-21 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting via "Product Files" (up to 4.15.14). CVE-2024-10518, https://www.wordfence.com/threat-intel/vulnerabilities/id/a6320203-2ee8-4316-96bc-0a8e1dd6b66a?source=api-prod
- 2024-05-22 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget (up to 4.15.8). CVE-2024-2861, https://www.wordfence.com/threat-intel/vulnerabilities/id/487731cd-da5a-45b6-8f39-4ae6420dd252?source=api-prod
- 2024-04-11 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 4.15.4). CVE-2024-2867, https://www.wordfence.com/threat-intel/vulnerabilities/id/4eb296af-547a-44aa-b804-833204b75256?source=api-prod
- 2024-04-09 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'reg-single-checkbox' (up to 4.15.5). CVE-2024-3210, https://www.wordfence.com/threat-intel/vulnerabilities/id/f4986bc3-ee34-43a6-bad2-9f6665adb35c?source=api-prod
- 2024-03-12 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (up to 4.15.2). CVE-2024-1535, https://www.wordfence.com/threat-intel/vulnerabilities/id/38ec1a6b-f5ee-446a-9e6c-3485dafb85ac?source=api-prod
- 2024-02-23 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode (up to 4.15.1). CVE-2024-1806, https://www.wordfence.com/threat-intel/vulnerabilities/id/d3b9d0ab-d785-4e93-9ab8-f75673a27334?source=api-prod
- 2024-02-22 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via [reg-select-role] Shortcode (up to 4.15.0). CVE-2024-1409, https://www.wordfence.com/threat-intel/vulnerabilities/id/53e16bca-7c85-4d56-8233-b3b53f793b39?source=api-prod
- 2024-02-19 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (up to 4.14.4). CVE-2024-1570, https://www.wordfence.com/threat-intel/vulnerabilities/id/46d4d573-3845-4d20-8a48-a2f28850383c?source=api-prod
- 2024-02-19 MEDIUM: Unauthenticated Stored Cross-Site Scripting (up to 4.14.4). CVE-2024-1519, https://www.wordfence.com/threat-intel/vulnerabilities/id/4ffd74de-6629-4088-ba5c-ac9dd5c6322c?source=api-prod
- 2024-02-19 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcode (up to 4.14.4). CVE-2024-1408, https://www.wordfence.com/threat-intel/vulnerabilities/id/6e50081f-6658-4cc7-bf0a-d04464820926?source=api-prod
- 2024-02-01 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 4.14.3). CVE-2024-1046, https://www.wordfence.com/threat-intel/vulnerabilities/id/7911c774-3fb0-4d6c-a847-101e5ad8637a?source=api-prod
- 2023-10-02 MEDIUM: Information Disclosure via Debug Log (up to 4.13.2). CVE-2023-44150, https://www.wordfence.com/threat-intel/vulnerabilities/id/8f5357e0-1e1b-4090-a6ae-9587c6a8d290?source=api-prod
- 2023-09-09 HIGH: Limited Privilege Escalation via 'acceptable_defined_roles' (before 4.13.2). CVE-2023-41954, https://www.wordfence.com/threat-intel/vulnerabilities/id/5b2840ee-3b48-415e-9bed-d34d0b6e36d7?source=api-prod
- 2023-09-09 MEDIUM: ProfilePress <= 4.13.1 Cross-Site Request Forgery via 'admin_notice' (before 4.13.2). CVE-2023-41953, https://www.wordfence.com/threat-intel/vulnerabilities/id/e103f59a-00fa-4d4c-b4fc-834754886d49?source=api-prod
- 2023-06-23 MEDIUM: Reflected Cross-Site Scripting via error message (before 4.11.0). WF-041e635a-9f97-4f54-8ecb-57bbbc321cfc, https://www.wordfence.com/threat-intel/vulnerabilities/id/041e635a-9f97-4f54-8ecb-57bbbc321cfc?source=api-prod
- 2023-03-27 HIGH: Unauthenticated Cross-Site Scripting (up to 4.5.3). CVE-2022-47444, https://www.wordfence.com/threat-intel/vulnerabilities/id/c8416840-c022-40a1-bcd3-17b34df11d95?source=api-prod
- 2023-02-21 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 4.5.4). CVE-2023-23830, https://www.wordfence.com/threat-intel/vulnerabilities/id/e4077fda-3f39-4e17-b7b8-3f1b6bf0a9e1?source=api-prod
- 2023-02-20 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes (up to 4.5.4). CVE-2023-23820, https://www.wordfence.com/threat-intel/vulnerabilities/id/5201963b-3b30-4e7a-9ad1-d9fa7bf629e5?source=api-prod
- 2023-01-20 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 4.5.3). CVE-2023-23996, https://www.wordfence.com/threat-intel/vulnerabilities/id/833006a6-462a-4729-8f3e-dca74a3802a2?source=api-prod
- 2022-12-23 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 4.5.0). CVE-2022-4697, https://www.wordfence.com/threat-intel/vulnerabilities/id/3d54f585-0116-4517-84f1-271e89a05539?source=api-prod
- 2022-12-23 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting via Form Settings (up to 4.5.0). CVE-2022-4698, https://www.wordfence.com/threat-intel/vulnerabilities/id/43c9dcec-f769-4c55-93d0-c2aa45a4fa16?source=api-prod
- 2022-12-14 MEDIUM: Authenticated (Admin+) PHP Object Injection (up to 4.3.2). CVE-2022-45083, https://www.wordfence.com/threat-intel/vulnerabilities/id/80127842-a931-41c7-9af8-3f0452a8c1a8?source=api-prod
- 2022-07-22 MEDIUM: Reflected Cross-Site Scripting (up to 3.2.15). WF-e532a2b4-0fb4-4256-89a9-435b55d9de91, https://www.wordfence.com/threat-intel/vulnerabilities/id/e532a2b4-0fb4-4256-89a9-435b55d9de91?source=api-prod
- 2021-11-15 MEDIUM: Reflected Cross-Site Scripting (before 3.2.3). CVE-2021-24955, https://www.wordfence.com/threat-intel/vulnerabilities/id/746b9ecc-49c1-4f6e-9f86-4147c98fe325?source=api-prod
- 2021-11-15 MEDIUM: Reflected Cross-Site Scripting via ppress_cc_data Parameter (before 3.2.3). CVE-2021-24954, https://www.wordfence.com/threat-intel/vulnerabilities/id/f2a87cb3-5cce-4b5a-937d-71e96aeef7c9?source=api-prod
- 2021-08-09 HIGH: Unauthenticated Cross-Site Scripting (up to 3.1.10). CVE-2021-24522, https://www.wordfence.com/threat-intel/vulnerabilities/id/684253b3-0a96-4822-84c8-bde8ed45f35e?source=api-prod
- 2021-06-28 MEDIUM: Authenticated Stored Cross-Site Scripting (before 3.1.8). CVE-2021-24450, https://www.wordfence.com/threat-intel/vulnerabilities/id/179821bb-5b0d-4c41-a410-db433987a870?source=api-prod
- 2021-06-28 CRITICAL: Unauthenticated Privilege Escalation (3.0.0 to 3.1.3). CVE-2021-34623, https://www.wordfence.com/threat-intel/vulnerabilities/id/57531d89-1f54-43f4-a19d-9fda5e69f2ad?source=api-prod
- 2021-06-28 CRITICAL: Arbitrary File Upload (3.0.0 to 3.1.3). CVE-2021-34624, https://www.wordfence.com/threat-intel/vulnerabilities/id/68e838d4-2ff2-4925-b2ff-ba3f7b379010?source=api-prod
- 2021-06-28 CRITICAL: Unauthenticated Privilege Escalation (3.0.0 to 3.1.3). CVE-2021-34621, https://www.wordfence.com/threat-intel/vulnerabilities/id/71955ba0-42ba-49a1-8b91-81069c6132ea?source=api-prod
- 2021-06-28 CRITICAL: Unauthenticated Privilege Escalation (3.0.0 to 3.1.3). CVE-2021-34622, https://www.wordfence.com/threat-intel/vulnerabilities/id/9bb2ae16-7886-4e66-83e0-59806dd67450?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=wp-user-avatar · HTML: https://todaywp.com/plugins/wp-user-avatar