Read the docs

ProfilePress

Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

ProfilePress records in CISA KEV

No ProfilePress vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Loginwp 3 records LOW User Registration, Login Form, User Profile & Membership 2 records LOW

Records

9 records

TI-2021-13635 CVE-2021-34621 · GHSA-h9qm-fw5r-9vmm

ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation

Priority CRITICAL 86

A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.68862 Published 2021-07-07 No fix listed CWE-269
TI-2021-13638 CVE-2021-34624 · GHSA-hq3q-v9v8-rcwf

ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in File Uploader Component

Priority HIGH 82

A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.07841 Published 2021-07-07 No fix listed CWE-434
TI-2021-13637 CVE-2021-34623 · GHSA-p4xw-fwjm-wh6h

ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in Image Uploader Component

Priority HIGH 82

A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or duri…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02101 Published 2021-07-07 No fix listed CWE-434
TI-2021-13636 CVE-2021-34622 · GHSA-mfv5-8vh8-pcqg

ProfilePress 3.0 - 3.1.3 - Authenticated Privilege Escalation

Priority HIGH 82

A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible for users to escalate their privileges to that of an administ…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0493 Published 2021-07-07 No fix listed CWE-269
TI-2021-07234 CVE-2021-24955 · GHSA-mg7h-r8f5-67xj

ProfilePress < 3.2.3 - Reflected Cross-Site Scripting

Priority LOW 29

The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attribute, lea…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01 Published 2021-12-13 Fixed in 3.2.3 CWE-79
TI-2021-07233 CVE-2021-24954 · GHSA-xhc5-mpp2-4rmp

ProfilePress < 3.2.3 - Reflected Cross-Site Scripting

Priority LOW 29

The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not sanitise and escape the ppress_cc_data parameter before outputting it back in an attribute of an admin dashboard page, l…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01 Published 2021-12-13 Fixed in 3.2.3 CWE-79
TI-2021-07218 CVE-2021-24939 · GHSA-8rq5-r7hg-52gr

LoginWP < 3.0.0.5 - Reflected Cross-Site Scripting

Priority LOW 29

The LoginWP (Formerly Peter's Login Redirect) WordPress plugin before 3.0.0.5 does not sanitise and escape the rul_login_url and rul_logout_url parameter before outputting them back in attributes in an admin page, leadin…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00827 Published 2021-12-06 Fixed in 3.0.0.5 CWE-79
Open these records in search →