Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

79 Quality Score

Active Installs

23/30

With 100,000 active installs it is widely adopted but still well behind WooCommerce at 7 million and several dedicated membership plugins in its category.

Update Freshness

25/25

It was updated on 2026-07-07, is tested with WordPress 7.0, and requires PHP 7.4, which is a clean and modern compatibility profile.

User Rating

9/15

A score of 62 out of 100 from 936 ratings is below average and the weakest signal in this assessment, suggesting real users have run into rough edges.

Support Health

8/15

Only one support thread exists with one resolution, so the 100 percent rate is statistically meaningless and tells us little about long-term support responsiveness.

WP Compatibility

15/15

Full marks here, with current WordPress and PHP requirements that match what most modern hosts run today.

Scores higher than 73% of indexed plugins

About

Setup paid membership, accept payment, sell subscription & digital product, paywall, create login & registration form, user profile & member directory

Active Installs 100k+

Rating ★★★ 3.1/5

Last Updated 2026-09-21 11:41am GMT

Requires WordPress 6.0+

Tested Up To 7.1.2

Requires PHP 7.4+

Security History

50 known vulnerabilities, all patched

5 Critical 10 High 35 Medium

Most recent: September 18, 2026

View details ▸

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket) High

September 18, 2026 Patched in ["4.17.3"] CVE-2026-85658

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.17.1 - Unauthenticated Arbitrary Plugin Installation via Brute Force High

August 31, 2026 Patched in ["4.17.2"] CVE-2026-66047

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution High

August 28, 2026 Patched in ["4.17.1"] CVE-2026-19848

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field Medium

August 15, 2026 Patched in ["4.17.0"] CVE-2026-18385

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion High

July 16, 2026 Patched in ["4.16.19"] CVE-2026-13352

ProfilePress <= 4.16.17 - Unauthenticated Privilege Escalation Critical

July 3, 2026 Patched in ["4.16.18"] CVE-2026-12497

ProfilePress <= 4.16.16 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation Medium

June 6, 2026 Patched in ["4.16.17"] CVE-2026-10820

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting Medium

April 23, 2026 Patched in ["4.16.14"] CVE-2026-41556

ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription Medium

April 15, 2026 Patched in ["4.16.13"] CVE-2026-4949

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields Medium

April 3, 2026 Patched in ["4.16.12"] CVE-2026-3309

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass High

April 3, 2026 Patched in ["4.16.12"] CVE-2026-3445

ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration High

March 10, 2026 Patched in ["4.16.12"] CVE-2026-3453

ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution Medium

December 8, 2025 Patched in ["4.16.8"] CVE-2025-13642

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution Medium

August 15, 2025 Patched in ["4.16.5"] CVE-2025-8878

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

January 23, 2025 Patched in ["4.15.20"] CVE-2024-13120

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

January 23, 2025 Patched in ["4.15.20"] CVE-2024-13121

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

January 23, 2025 Patched in ["4.15.20"] CVE-2024-13119

ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure Medium

November 26, 2024 Patched in ["4.15.19"] CVE-2024-11083

ProfilePress <= 4.15.14 - Authenticated (Admin+) Stored Cross-Site Scripting via "Labels" Medium

November 21, 2024 Patched in ["4.15.15"] CVE-2024-10517

ProfilePress <= 4.15.14 - Authenticated (Admin+) Stored Cross-Site Scripting via "Product Files" Medium

November 21, 2024 Patched in ["4.15.15"] CVE-2024-10518

ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget Medium

May 22, 2024 Patched in ["4.15.9"] CVE-2024-2861

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

April 11, 2024 Patched in ["4.15.5"] CVE-2024-2867

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'reg-single-checkbox' Medium

April 9, 2024 Patched in ["4.15.6"] CVE-2024-3210

ProfilePress <= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Medium

March 12, 2024 Patched in ["4.15.3"] CVE-2024-1535

ProfilePress <= 4.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode Medium

February 23, 2024 Patched in ["4.15.2"] CVE-2024-1806

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via [reg-select-role] Shortcode Medium

February 22, 2024 Patched in ["4.15.1"] CVE-2024-1409

ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Medium

February 19, 2024 Patched in ["4.15.0"] CVE-2024-1570

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.4 - Unauthenticated Stored Cross-Site Scripting Medium

February 19, 2024 Patched in ["4.15.0"] CVE-2024-1519

ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcode Medium

February 19, 2024 Patched in ["4.15.0"] CVE-2024-1408

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

February 1, 2024 Patched in ["4.14.4"] CVE-2024-1046

ProfilePress <= 4.13.2 - Information Disclosure via Debug Log Medium

October 2, 2023 Patched in ["4.13.3"] CVE-2023-44150

ProfilePress <= 4.13.1 - Limited Privilege Escalation via 'acceptable_defined_roles' High

September 9, 2023 Patched in ["4.13.2"] CVE-2023-41954

ProfilePress <= 4.13.1 Cross-Site Request Forgery via 'admin_notice' Medium

September 9, 2023 Patched in ["4.13.2"] CVE-2023-41953

ProfilePress <= 4.10.3 - Reflected Cross-Site Scripting via error message Medium

June 23, 2023 Patched in ["4.11.0"]

ProfilePress <= 4.5.3 - Unauthenticated Cross-Site Scripting High

March 27, 2023 Patched in ["4.5.4"] CVE-2022-47444

ProfilePress <= 4.5.4 - Unauthenticated Stored Cross-Site Scripting High

February 21, 2023 Patched in ["4.5.5"] CVE-2023-23830

ProfilePress <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes Medium

February 20, 2023 Patched in ["4.5.5"] CVE-2023-23820

ProfilePress <= 4.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

January 20, 2023 Patched in ["4.5.4"] CVE-2023-23996

ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

December 23, 2022 Patched in ["4.5.1"] CVE-2022-4697

ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form Settings Medium

December 23, 2022 Patched in ["4.5.1"] CVE-2022-4698

ProfilePress <= 4.3.2 - Authenticated (Admin+) PHP Object Injection Medium

December 14, 2022 Patched in ["4.4.0"] CVE-2022-45083

WordPress Membership, User Registration, Login Form, User Profile & Restrict Content Plugin – ProfilePress <= 3.2.15 - Reflected Cross-Site Scripting Medium

July 22, 2022 Patched in ["3.2.16"]

ProfilePress <= 3.2.2 - Reflected Cross-Site Scripting Medium

November 15, 2021 Patched in ["3.2.3"] CVE-2021-24955

ProfilePress <= 3.2.2 - Reflected Cross-Site Scripting via ppress_cc_data Parameter Medium

November 15, 2021 Patched in ["3.2.3"] CVE-2021-24954

Paid Membership, User Registration, User Profile & Restrict Content Plugin – ProfilePress <= 3.1.10 - Unauthenticated Cross-Site Scripting High

August 9, 2021 Patched in ["3.1.11"] CVE-2021-24522

ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload Critical

June 28, 2021 Patched in ["3.1.4"] CVE-2021-34624

ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation Critical

June 28, 2021 Patched in ["3.1.4"] CVE-2021-34622

ProfilePress <= 3.1.7 - Authenticated Stored Cross-Site Scripting Medium

June 28, 2021 Patched in ["3.1.8"] CVE-2021-24450

User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation Critical

June 28, 2021 Patched in ["3.1.4"] CVE-2021-34623

User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation Critical

June 28, 2021 Patched in ["3.1.4"] CVE-2021-34621

What It Does

ProfilePress bundles several membership-related features into one plugin, including paid membership tiers, payment and subscription handling, paywalled content, custom login and registration forms, user profile editing, and a member directory. In practice, you can gate content behind paid plans, accept recurring or one-time payments, and replace the default WordPress profile area without installing separate plugins for each job.

Who It's For

This is best suited for creators, small businesses, and educators running a single WordPress site who want to sell subscriptions, gated content, or digital products and need login, registration, and profile pages handled in one package. It works well for those who do not want the complexity or cost of a full LMS or large ecommerce suite.

Who Should Skip It

If you already run WooCommerce or need deep ecommerce features such as shipping, tax calculation, and physical product fulfilment, ProfilePress will feel thin and you are better served by a dedicated storefront plugin. Large membership sites with thousands of paying users and complex tier structures may also outgrow its feature set.

The Bottom Line

ProfilePress is a competent all-in-one membership bundle with excellent maintenance signals and a broad feature list, but its 62 out of 100 user rating is a real warning sign worth investigating in recent reviews before committing. For a small subscription or content paywall site it can save you from installing three or four separate plugins, and our overall quality score of 79.19 reflects that balance of strengths and risk.

Related Plugins

WooCommerce 96/100

Pick WooCommerce if you need a full ecommerce engine with products, shipping, and tax handling, and add a membership extension on top.

Members 94/100

Pick Members if you only need role editing and content restriction without any payment or subscription features.

Download Monitor 90/100

Pick Download Monitor if your main goal is selling or gating file downloads rather than full subscription membership.

User Profile Builder 90/100

Pick Profile Builder if you mainly want polished registration and profile forms without the paid membership layer.

Ultimate Member 90/100

Pick Ultimate Member if you want a larger community and proven member directory features with twice the install base.

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

About

Security History

What It Does

Who It's For

Who Should Skip It

The Bottom Line

Related Plugins

Tags