Skip to content
PluginCanary

ProfilePress

ProfilePress - Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
by properfraction · 100,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 31 Oct 2026, 38 releases in 24 months, no unpatched vulnerabilities.

86/ 100 Canary Score
Sub-scores for ProfilePress
Ownership100
Maintenance100
Security60
SupportNo data
Reputation85

How the score works

Quick answers

Is ProfilePress still maintained?
Yes. Last release 31 Oct 2026, 38 releases in the last 24 months. 31 Oct 2026 · wordpress.org
Who owns ProfilePress, and has it changed hands?
No change recorded. Main committer Collizo4sky since Apr 2020. 4 Nov 2026 · SVN log
Was ProfilePress removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is ProfilePress safe?
55 known vulnerabilities, all fixed (latest in 4.17.6). Not on the exploited list. 15 Oct 2026 · Wordfence Intelligence
Is the latest ProfilePress update safe to install?
No ownership change before 4.18.0. No one-star spike after it. 31 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
flippercode13 Jun 2014 to 20 Feb 2020, 65 commits
Collizo4sky15 Apr 2020 to 31 Oct 2026, 342 commits

2 committers recorded. No ownership change since 2013.

Maintenance

Last release
4 days ago
Releases, 24 months
38
Tested up to
7.1 current
Requires PHP
8.0 supported 8.2+
Releases per quarter
Releases per quarter for ProfilePress
Q1 20248
Q2 20245
Q3 20244
Q4 20246
Q1 20253
Q2 20256
Q3 20254
Q4 20252
Q1 20264
Q2 20266
Q3 20267
Q4 20263

Last release 31 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 5.0 (2 reviews). Lifetime: 3.1.

Average rating per quarter for ProfilePress
Q4 20245.0
Q1 20255.0
Q2 20255.0
Q3 20254.3
Q4 20255.0
Q1 20264.5
Q2 20264.2
Q3 20265.0

Average rating stayed at 5.0 between Q4 2024 and Q3 2026.

Rating distribution
5 star470
4 star18
3 star14
2 star19
1 star417
Latest low reviews

Security record

25 vulnerabilities in 24 months (55 on record), all patched (latest fixed in 4.17.6).

Show 55 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
15 Oct 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab5.4<= 4.17.54.17.6Patched before disclosure
2 Oct 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter6.1<= 4.17.44.17.5Patched before disclosure
2 Oct 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields8.8<= 4.17.44.17.5Patched before disclosure
2 Oct 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress <= 4.17.3 - Missing Authorization4.3<= 4.17.34.17.4Patched before disclosure
2 Oct 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress <= 4.17.3 - Missing Authorization5.3<= 4.17.34.17.4Patched before disclosure
18 Sep 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)8.1<= 4.17.24.17.3Patched before disclosure
31 Aug 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress <= 4.17.1 - Unauthenticated Arbitrary Plugin Installation via Brute Force8.1<= 4.17.14.17.2Patched before disclosure
28 Aug 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution7.3< 4.17.14.17.1Patched before disclosure
15 Aug 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field5.4<= 4.16.194.17.0Patched before disclosure
16 Jul 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion8.8<= 4.16.184.16.19Patched before disclosure
3 Jul 2026ProfilePress <= 4.16.17 - Unauthenticated Privilege Escalation9.8<= 4.16.174.16.18Patched before disclosure
6 Jun 2026ProfilePress <= 4.16.16 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation4.3<= 4.16.164.16.17Patched before disclosure
23 Apr 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress <= 4.16.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4<= 4.16.134.16.14Patched before disclosure
15 Apr 2026ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription4.3<= 4.16.124.16.13Patched before disclosure
3 Apr 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields6.5<= 4.16.114.16.12Patched before disclosure
3 Apr 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass7.1<= 4.16.114.16.12Patched before disclosure
10 Mar 2026ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration8.1<= 4.16.114.16.12Patched before disclosure
8 Dec 2025ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution5.4<= 4.16.74.16.8Patched before disclosure
15 Aug 2025Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution6.5<= 4.16.44.16.51
23 Jan 2025Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress <= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting4.4<= 4.15.194.15.20Patched before disclosure
23 Jan 2025Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress <= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting4.4<= 4.15.194.15.20Patched before disclosure
23 Jan 2025Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress <= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting4.4<= 4.15.194.15.20Patched before disclosure
26 Nov 2024ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure5.3<= 4.15.184.15.19Patched before disclosure
21 Nov 2024ProfilePress <= 4.15.14 - Authenticated (Admin+) Stored Cross-Site Scripting via "Labels"4.4<= 4.15.144.15.15Patched before disclosure
21 Nov 2024ProfilePress <= 4.15.14 - Authenticated (Admin+) Stored Cross-Site Scripting via "Product Files"4.4<= 4.15.144.15.15Patched before disclosure

Changelog mentions of security fixes: 4.16.19 (security); 4.17.0 (security); 4.17.1 (security); 4.17.2 (security); 4.17.3 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

100% of 1 support threads resolved in the last 2 months.

Momentum

100,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for ProfilePress
4 May 202637,459
11 May 20269,184
18 May 20269,774
25 May 20265,601
1 Jun 202670,620
8 Jun 20268,440
15 Jun 20265,585
22 Jun 202638,703
29 Jun 20267,845
6 Jul 202643,073
13 Jul 20268,975
20 Jul 20266,357
27 Jul 20266,941
3 Aug 202643,587
10 Aug 20267,891
17 Aug 202645,574
24 Aug 202641,921
31 Aug 202638,913
7 Sep 202641,288
14 Sep 202614,379
21 Sep 202646,462
28 Sep 202638,087
5 Oct 202615,016
12 Oct 202637,847
19 Oct 202613,813
26 Oct 202634,237
2 Nov 20262,795

Weekly downloads over the last 4 weeks are 12% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Gravatar EnhancedScore 100 · 100,000+WP User AvatarsScore 100 · 20,000+One User AvatarScore 96 · 100,000+Simple Local AvatarsScore 96 · 100,000+LoginWP (Formerly Peter's LoginScore 96 · 80,000+

Facts

Version4.18.0
Authorproperfraction
Added14 Jan 2013
Last updated31 Oct 2026
Active installs100,000+
Requires WordPress6.9
Tested up to7.1.4
Requires PHP8.0
CategoryE-commerce & Shopping
Tagslms, course, ecommerce, membership, User Registration

Other plugins by this author: kk Star Ratings - Rate Post & Collect User Feedbacks, CrawlWP SEO - Complete WordPress SEO Plugin with AI, Indexing & Search Performance, Rate My Post - Star Rating Plugin by FeedbackWP, MailOptin - Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.

Questions

Is ProfilePress still maintained?

Yes. Last release 31 Oct 2026, 38 releases in the last 24 months.

Who owns ProfilePress, and has it changed hands?

No change recorded. Main committer Collizo4sky since Apr 2020.

Was ProfilePress removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is ProfilePress safe?

55 known vulnerabilities, all fixed (latest in 4.17.6). Not on the exploited list.

Is the latest ProfilePress update safe to install?

No ownership change before 4.18.0. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue