Medium · 5.9 CVE-2023-23996 EUVD-2023-28060GHSA-p7m2-926f-xqc9

WordPress ProfilePress Plugin <= 4.5.3 is vulnerable to Cross Site Scripting (XSS)

Published Apr 6, 2023 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: ProfilePress Membership Team Product: ProfilePress

Description

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.3 versions.

Affected products

Vendor	Product	Affected	Fixed
ProfilePress Membership Team	ProfilePress	≤ 4.5.3	—

References

https://patchstack.com/database/vulnerability/wp-user-avatar/wordpress-paid-membership-ecommerce-registration-form-login-form-user-profile-paywall-restrict-content-profilepress-plugin-4-5-3-cross-site-scripting-xss?_s_id=cve vdb-entry