Skip to content
Sign in
6.5 Medium

CVE-2026-3309 The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content –…

Description

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.11. This is due to the plugin allowing user-supplied billing field values from the checkout process to be interpolated into shortcode template strings that are subsequently processed without proper sanitization of shortcode syntax. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes by submitting crafted billing field values during the checkout process.

Affected products and versions

Product Affected versions Fixed in
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress 4.16 earliest → 4.16.11 No fix stated

Other CVEs of Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

The 25 CVEs of Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress →
CVE-2026-104003 The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to,… 5.4 Medium CVE-2026-92536 The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content –… 8.8 High CVE-2026-92551 The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content –… 6.1 Medium CVE-2026-85658 The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content –… 8.1 High
Track this CVE