EUVD-2026-11074

The ProfilePress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.16.11. This is due to missing ownership validation on the changeplansubid parameter in the processcheckout function. The ppressprocesscheckout AJAX handler accepts a...

WordPress ProfilePress plugin < 4.15.20 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin ProfilePress versions 4.15.20...

WordPress ProfilePress plugin <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Nguyen Ngoc Quang Bach maysbachs in WordPress Plugin ProfilePress versions = 4.16.7...

EUVD-2021-21273

Malware in sbrugna...

EUVD-2024-27805

Malicious code in bioql PyPI...

EUVD-2023-27916

Malicious code in bioql PyPI...

EUVD-2024-16822

Malicious code in bioql PyPI...

EUVD-2022-48004

Malicious code in bioql PyPI...

EUVD-2023-27906

Malicious code in bioql PyPI...

EUVD-2024-17283

Malicious code in bioql PyPI...

EUVD-2022-50206

Malicious code in bioql PyPI...

EUVD-2025-28807

Malicious code in bioql PyPI...

EUVD-2023-28060

Malicious code in bioql PyPI...

EUVD-2024-27811

Malicious code in bioql PyPI...

EUVD-2024-31802

Malicious code in bioql PyPI...

CVE-2025-8878

The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.4. This is due to the software allowing users to execute an...

CVE-2025-8878

The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.4. This is due to the software allowing users to execute an...

CVE-2025-8878

CVE-2025-8878 affects the Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress for WordPress. Affected versions are all up to 4.16.4. Root cause: unauthenticated user-supplied input is not properly validated before executing do_shor...

WordPress ProfilePress plugin <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by WordFence in WordPress Plugin ProfilePress versions = 4.16.4...

CVE-2024-1806

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 4.15.1 due to insufficient input sanitizati...