CVE-2026-92536

The ProfilePress plugin for WordPress (all versions up to and including 4.17.4 ) is vulnerable to Sensitive Information Exposure via the get_user_profile_structure function. Authenticated attackers with subscriber-level access or higher can extract other users' email addresses, login names, and r...

PT-2026-104488

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the get user profile structure. This makes it possible fo...

CVE-2026-92536: Improper Control of Generation of Code

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the getuserprofilestructure. This makes it possible for...

PT-2026-104490

Name of the Vulnerable Software and Affected Versions ProfilePress versions prior to 4.17.5 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when a malicious filename is supplied to the ppress...

PT-2024-24405

Name of the Vulnerable Software and Affected Versions ProfilePress plugin for WordPress versions up to, and including, 4.15.5 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'reg-single-checkbox' shortcode due to insufficient input sanitization and output escaping...