ProfilePress Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode – CVE-2024-1806 | WordPress Plugin Vulnerability Report

Plugin Name: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

Key Information:

  • Software Type: Plugin
  • Software Slug: wp-user-avatar
  • Software Status: Active
  • Software Author: collizo4sky
  • Software Downloads: 12,533,974
  • Active Installs: 200,000
  • Last Updated: February 27, 2024
  • Patched Versions: 4.15.1
  • Affected Versions: <= 4.15.1

Vulnerability Details:

  • Name: ProfilePress <= 4.15.1
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-1806
  • CVSS Score: 6.4
  • Publicly Published: February 23, 2024
  • Researcher: wesley
  • Description: The ProfilePress plugin, a comprehensive solution for user registration, profiles, and content restriction, has been found to have a stored cross-site scripting (XSS) vulnerability. This flaw is present in all versions up to 4.15.1 and stems from the plugin's handling of the profilepress-edit-profile shortcode, which lacks adequate input sanitization and output escaping for user-supplied attributes. As a result, authenticated users with contributor-level permissions or higher can exploit this vulnerability to inject harmful scripts into web pages, compromising site integrity and user security.


The ProfilePress plugin, essential for WordPress sites requiring advanced user management and content restriction features, faces a significant security challenge with CVE-2024-1806. This vulnerability allows for stored XSS attacks through a commonly used shortcode, posing a risk to both site functionality and user safety. Thankfully, the developers have addressed this issue in the latest patch, version 4.15.1.

Detailed Overview:

Discovered by the researcher wesley, this vulnerability highlights the critical need for stringent input validation and output encoding in plugin development. The ability for attackers to inject arbitrary scripts poses a myriad of risks, including unauthorized access, data theft, and disruption of site services. The release of patch 4.15.1 rectifies this vulnerability, reinforcing the plugin's defenses against XSS attacks.

Advice for Users:

  • Immediate Action: Users are strongly encouraged to update their ProfilePress plugin to version 4.15.1 immediately to protect against this vulnerability.
  • Check for Signs of Vulnerability: Administrators should monitor their sites for unusual activity or unauthorized content changes, especially in areas utilizing the affected shortcode.
  • Alternate Plugins: While the patched version is secure, exploring alternative plugins with similar functionality might be prudent for users seeking additional security assurances.
  • Stay Updated: Regular updates are the cornerstone of website security. Ensure that all WordPress components, including themes and plugins, are kept up-to-date to safeguard against known vulnerabilities.


The rapid identification and patching of CVE-2024-1806 within the ProfilePress plugin underscore the ongoing importance of cybersecurity vigilance in the WordPress ecosystem. For small business owners managing WordPress sites, this incident serves as a poignant reminder of the necessity of maintaining up-to-date plugins and implementing comprehensive security strategies. By adopting proactive security measures, staying informed about potential vulnerabilities, and conducting regular site audits, website owners can significantly mitigate the risk of security breaches and ensure a safe online environment for their users.


In an era where WordPress acts as the digital backbone for a myriad of websites, plugins like ProfilePress enhance functionality and enrich user experience, proving indispensable for site management. However, the discovery of CVE-2024-1806 within ProfilePress casts a spotlight on a crucial digital responsibility: the need for consistent vigilance and timely updates to ensure website security. This vulnerability serves as a stark reminder that, in the digital world, proactive measures are not just recommended but essential for safeguarding online assets.

Plugin Overview:

ProfilePress, developed by collizo4sky, is a robust WordPress plugin designed to streamline user registration, profile management, ecommerce, and content restriction. With over 12 million downloads and 200,000 active installations, its impact on the WordPress community is significant. Yet, its utility comes with the responsibility to maintain its security integrity, as evidenced by the recent vulnerability.

Vulnerability Insights:

CVE-2024-1806 exposes a Stored Cross-Site Scripting (XSS) flaw in versions up to 4.15.1 of ProfilePress. Originating from inadequate input sanitization within the profilepress-edit-profile shortcode, this vulnerability enables authenticated users with contributor-level access to inject malicious scripts, compromising both site integrity and user security. This risk underscores the critical need for stringent security practices in plugin development and maintenance.

Risks and Impacts:

The potential repercussions of CVE-2024-1806 are far-reaching, from unauthorized data access and theft to the manipulation of site content and functionality. For small business owners, the implications extend beyond technical disruptions to potentially eroding customer trust and damaging the business's digital reputation.

Remediation and Prevention:

In response to this vulnerability, the developers of ProfilePress have released a crucial update in version 4.15.1. Website administrators are urged to apply this patch promptly to mitigate risks. Furthermore, regular monitoring for unusual site activity and exploring alternative plugins with a strong security record can provide additional layers of protection.

Historical Context:

ProfilePress has encountered 25 vulnerabilities since June 28, 2021, highlighting the ongoing challenge of securing complex software in an evolving threat landscape. Each vulnerability addressed strengthens the plugin's security posture, contributing to a safer WordPress ecosystem.


The swift resolution of CVE-2024-1806 by ProfilePress's development team exemplifies the critical nature of timely software updates in the realm of cybersecurity. For small business owners managing WordPress sites, this event underscores the importance of staying informed about potential vulnerabilities, regularly updating software components, and employing comprehensive security measures. In the digital age, safeguarding a website is not just about protecting data; it's about preserving the trust and confidence of every user who visits your site. Embracing a proactive security stance is indispensable in navigating the digital landscape securely and successfully.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

ProfilePress Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode – CVE-2024-1806 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment