ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

593 searches this plugin appeared in over the last 90 days, 20 listed. 492 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 17 months ago; the previous band took 22 months to cross, which places it about 50% of the way through.

1. ★★★★★ 1question

   5mo ago

   Hi, Big thanks for this plugin : )

   Read on wp.org ↗
2. ★★★★★ jacobdreizin

   5mo ago

   My paywalled/subscription website crashed when ProfilePress pushed an update with a small error in the coding (in the part responsible for user avatar pics, of all things), but the support was very responsive, and resolved the problem on the same day, in fact within at most 5 hours of my first communication, which I was really not expecting. Thank you!

   Read on wp.org ↗
3. ★★★★★ mvxweb

   5mo ago

   The content restriction feature is straightforward and works reliably. Tested with different user accounts and membership levels, and access was always enforced correctly. No fuss. No confusing setup.

   Read on wp.org ↗
4. ★★★★★ Ryan

   6mo ago

   This is an excellent plug‑in. I’m surprised I haven’t heard about it before. Shockingly, it integrates with multiple prominent LMS platforms, including LearnDash, and the platform is very user‑friendly. So I feel I’ve got great value for money. I hope the developers or the owners keep updating and improving the plugin.

   Read on wp.org ↗
5. ★★★★★ negru13

   7mo ago

   This used to be WP User Avatar. Now is this bloated usless plugin. Not what I asked for.

   Read on wp.org ↗
6. ★★★★★ weswebmaster

   8mo ago

   We are working towards a new website, and the ProfilePress team have been extremely supportive in answering queries and even responding to feature requests. Great team! Thank you.

   Read on wp.org ↗
7. ★★★★★ chaney220

   10mo ago

   I was using Profile Press for a little bit but found that it just didn’t have all of the options that I needed for my customers’ profiles. I started using Ultimate Member, and it has many more features.

   Read on wp.org ↗
8. ★★★★★ devmickey

   10mo ago

   ​ I’ve been using ProfilePress for memberships and payments, and it has become a core part of my WordPress setup. It’s a powerful ecommerce and paid membership plugin that supports one-time and recurring payments, selling subscriptions, and restricting content behind a paywall with access to control rules. Their plugin is well documented, so everyone should be able to set it up. On top of that, it’s very flexible on the front end: you can build custom registration, login, password reset, and edit-profile forms using a drag-and-drop builder, and you can also create user profiles and member directories. What truly stands out is their team: fast responses, clear answers, and genuine willingness to think along and propose practical solutions. Special mention to Ibrahim and Collins who consistently go above and beyond with tailored fixes and implementations. They really do listen to their community and have a can-do mentality when it comes to changing the product to meet customer expectations. Overall, highly recommended for anyone building a membership site or selling digital products on WordPress. Good luck on the further development!

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 4.16.19 Add optional order creation to the Add New Customer screen. Fixed bug where suppressed email still went out. Fixed security issue where other file types (exe, msi) could be uploaded outside ProfilePress upload scope. Imp 4.16.19
2. — Version 4.16.18 Added compatibility with Yoast URL Cleanup feature. Fix security issue where non-admin user role can be passed as user role. 4.16.18
3. — Version 4.16.17 Fixed security issue a user subscription can be canceled by another user. 4.16.17
4. — Version 4.16.16 Pro: Paddle addon . Added password visibility icons to the password reset handler form fields 4.16.16
5. — Version 4.16.15 Pro: Brevo addon . Pro: Auto-Renewal Checkbox addon . Added filters to the test mode notice and checkout username. Added membership conditions to Elementor display rules. See the changelog file for full change log inform 4.16.15
6. — Version 4.17.0 Premium: Added Pay What You Want addon . Added Subscription Payment Failed email notification. Fixed Stripe bug where email change caused checkout failure. Fixed fatal error when price has a currency symbol or thousands 4.17.0

All 55 disclosed vulnerabilities are patched in the current version (4.18.0). Sites still on an older version should update.

1. Patched Medium · 5.4 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab ↗
   2026-10-15 CVE-2026-104003 Improper Control of Generation of Code Affects <= 4.17.5 Patched in 4.17.6
2. Patched Medium · 6.1 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter ↗
   2026-10-02 CVE-2026-92551 Improper Neutralization of Input During Web Page Generation Affects <= 4.17.4 Patched in 4.17.5
3. Patched High · 8.8 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields ↗
   2026-10-02 CVE-2026-92536 Improper Control of Generation of Code Affects <= 4.17.4 Patched in 4.17.5
4. Patched Medium · 4.3 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.17.3 - Missing Authorization ↗
   2026-10-02 CVE-2026-96337 Missing Authorization Affects <= 4.17.3 Patched in 4.17.4
5. Patched Medium · 5.3 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.17.3 - Missing Authorization ↗
   2026-10-02 CVE-2026-96518 Missing Authorization Affects <= 4.17.3 Patched in 4.17.4
6. Patched High · 8.1 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket) ↗
   2026-09-18 CVE-2026-85658 Improper Control of Generation of Code Affects <= 4.17.2 Patched in 4.17.3
7. Patched High · 8.1 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.17.1 - Unauthenticated Arbitrary Plugin Installation via Brute Force ↗
   2026-08-31 CVE-2026-66047 Improper Control of Generation of Code Affects <= 4.17.1 Patched in 4.17.2
8. Patched High · 7.3 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution ↗
   2026-08-28 CVE-2026-19848 Improper Control of Generation of Code Affects < 4.17.1 Patched in 4.17.1
9. Patched Medium · 5.4 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field ↗
   2026-08-15 CVE-2026-18385 Improper Control of Generation of Code Affects <= 4.16.19 Patched in 4.17.0
10. Patched High · 8.8 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion ↗
    2026-07-16 CVE-2026-13352 Unrestricted Upload of File with Dangerous Type Affects <= 4.16.18 Patched in 4.16.19
11. Patched Critical · 9.8 ProfilePress <= 4.16.17 - Unauthenticated Privilege Escalation ↗
    2026-07-03 CVE-2026-12497 Improper Privilege Management Affects <= 4.16.17 Patched in 4.16.18
12. Patched Medium · 4.3 ProfilePress <= 4.16.16 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation ↗
    2026-06-06 CVE-2026-10820 Authorization Bypass Through User-Controlled Key Affects <= 4.16.16 Patched in 4.16.17
13. Patched Medium · 6.4 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
    2026-04-23 CVE-2026-41556 Improper Neutralization of Input During Web Page Generation Affects <= 4.16.13 Patched in 4.16.14
14. Patched Medium · 4.3 ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription ↗
    2026-04-15 CVE-2026-4949 Missing Authorization Affects <= 4.16.12 Patched in 4.16.13
15. Patched Medium · 6.5 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields ↗
    2026-04-03 CVE-2026-3309 Improper Control of Generation of Code Affects <= 4.16.11 Patched in 4.16.12
16. Patched High · 7.1 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass ↗
    2026-04-03 CVE-2026-3445 Missing Authorization Affects <= 4.16.11 Patched in 4.16.12
17. Patched High · 8.1 ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration ↗
    2026-03-10 CVE-2026-3453 Authorization Bypass Through User-Controlled Key Affects <= 4.16.11 Patched in 4.16.12
18. Patched Medium · 5.4 ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution ↗
    2025-12-08 CVE-2025-13642 Improper Control of Generation of Code Affects <= 4.16.7 Patched in 4.16.8
19. Patched Medium · 6.5 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution ↗
    2025-08-15 CVE-2025-8878 Improper Control of Generation of Code Affects <= 4.16.4 Patched in 4.16.5
20. Patched Medium · 4.4 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-01-23 CVE-2024-13120 Improper Neutralization of Input During Web Page Generation Affects <= 4.15.19 Patched in 4.15.20
21. Patched Medium · 4.4 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-01-23 CVE-2024-13121 Improper Neutralization of Input During Web Page Generation Affects <= 4.15.19 Patched in 4.15.20
22. Patched Medium · 4.4 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-01-23 CVE-2024-13119 Improper Neutralization of Input During Web Page Generation Affects <= 4.15.19 Patched in 4.15.20
23. Patched Medium · 5.3 ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure ↗
    2024-11-26 CVE-2024-11083 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 4.15.18 Patched in 4.15.19
24. Patched Medium · 4.4 ProfilePress <= 4.15.14 - Authenticated (Admin+) Stored Cross-Site Scripting via "Labels" ↗
    2024-11-21 CVE-2024-10517 Improper Neutralization of Input During Web Page Generation Affects <= 4.15.14 Patched in 4.15.15
25. Patched Medium · 4.4 ProfilePress <= 4.15.14 - Authenticated (Admin+) Stored Cross-Site Scripting via "Product Files" ↗
    2024-11-21 CVE-2024-10518 Improper Neutralization of Input During Web Page Generation Affects <= 4.15.14 Patched in 4.15.15
26. Patched Medium · 6.4 ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget ↗
    2024-05-22 CVE-2024-2861 Improper Neutralization of Input During Web Page Generation Affects <= 4.15.8 Patched in 4.15.9
27. Patched Medium · 6.4 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.4 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-04-11 CVE-2024-2867 Improper Input Validation Affects <= 4.15.4 Patched in 4.15.5
28. Patched Medium · 6.4 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'reg-single-checkbox' ↗
    2024-04-09 CVE-2024-3210 Improper Neutralization of Input During Web Page Generation Affects <= 4.15.5 Patched in 4.15.6
29. Patched Medium · 6.4 ProfilePress <= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2024-03-12 CVE-2024-1535 Improper Neutralization of Input During Web Page Generation Affects <= 4.15.2 Patched in 4.15.3
30. Patched Medium · 6.4 ProfilePress <= 4.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode ↗
    2024-02-23 CVE-2024-1806 Improper Neutralization of Input During Web Page Generation Affects <= 4.15.1 Patched in 4.15.2
31. Patched Medium · 6.4 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via [reg-select-role] Shortcode ↗
    2024-02-22 CVE-2024-1409 Improper Neutralization of Input During Web Page Generation Affects <= 4.15.0 Patched in 4.15.1
32. Patched Medium · 6.4 ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2024-02-19 CVE-2024-1570 Improper Neutralization of Input During Web Page Generation Affects <= 4.14.4 Patched in 4.15.0
33. Patched Medium · 6.5 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.4 - Unauthenticated Stored Cross-Site Scripting ↗
    2024-02-19 CVE-2024-1519 Improper Neutralization of Input During Web Page Generation Affects <= 4.14.4 Patched in 4.15.0
34. Patched Medium · 6.4 ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcode ↗
    2024-02-19 CVE-2024-1408 Improper Neutralization of Input During Web Page Generation Affects <= 4.14.4 Patched in 4.15.0
35. Patched Medium · 6.4 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-02-01 CVE-2024-1046 Improper Neutralization of Input During Web Page Generation Affects <= 4.14.3 Patched in 4.14.4
36. Patched Medium · 5.3 ProfilePress <= 4.13.2 - Information Disclosure via Debug Log ↗
    2023-10-02 CVE-2023-44150 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 4.13.2 Patched in 4.13.3
37. Patched High · 7.3 ProfilePress <= 4.13.1 - Limited Privilege Escalation via 'acceptable_defined_roles' ↗
    2023-09-09 CVE-2023-41954 Improper Input Validation Affects < 4.13.2 Patched in 4.13.2
38. Patched Medium · 4.3 ProfilePress <= 4.13.1 Cross-Site Request Forgery via 'admin_notice' ↗
    2023-09-09 CVE-2023-41953 Cross-Site Request Forgery Affects < 4.13.2 Patched in 4.13.2
39. Patched Medium · 6.1 ProfilePress <= 4.10.3 - Reflected Cross-Site Scripting via error message ↗
    2023-06-23 Improper Neutralization of Input During Web Page Generation Affects < 4.11.0 Patched in 4.11.0
40. Patched High · 7.2 ProfilePress <= 4.5.3 - Unauthenticated Cross-Site Scripting ↗
    2023-03-27 CVE-2022-47444 Improper Neutralization of Input During Web Page Generation Affects <= 4.5.3 Patched in 4.5.4
41. Patched High · 7.2 ProfilePress <= 4.5.4 - Unauthenticated Stored Cross-Site Scripting ↗
    2023-02-21 CVE-2023-23830 Improper Neutralization of Input During Web Page Generation Affects <= 4.5.4 Patched in 4.5.5
42. Patched Medium · 6.4 ProfilePress <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes ↗
    2023-02-20 CVE-2023-23820 Improper Neutralization of Input During Web Page Generation Affects <= 4.5.4 Patched in 4.5.5
43. Patched Medium · 5.5 ProfilePress <= 4.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2023-01-20 CVE-2023-23996 Improper Neutralization of Input During Web Page Generation Affects <= 4.5.3 Patched in 4.5.4
44. Patched Medium · 5.5 ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2022-12-23 CVE-2022-4697 Improper Neutralization of Input During Web Page Generation Affects <= 4.5.0 Patched in 4.5.1
45. Patched Medium · 5.5 ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form Settings ↗
    2022-12-23 CVE-2022-4698 Improper Neutralization of Input During Web Page Generation Affects <= 4.5.0 Patched in 4.5.1
46. Patched Medium · 6.6 ProfilePress <= 4.3.2 - Authenticated (Admin+) PHP Object Injection ↗
    2022-12-14 CVE-2022-45083 Deserialization of Untrusted Data Affects <= 4.3.2 Patched in 4.4.0
47. Patched Medium · 6.1 WordPress Membership, User Registration, Login Form, User Profile & Restrict Content Plugin – ProfilePress <= 3.2.15 - Reflected Cross-Site Scripting ↗
    2022-07-22 Improper Neutralization of Input During Web Page Generation Affects <= 3.2.15 Patched in 3.2.16
48. Patched Medium · 6.1 ProfilePress <= 3.2.2 - Reflected Cross-Site Scripting ↗
    2021-11-15 CVE-2021-24955 Improper Neutralization of Input During Web Page Generation Affects < 3.2.3 Patched in 3.2.3
49. Patched Medium · 6.1 ProfilePress <= 3.2.2 - Reflected Cross-Site Scripting via ppress_cc_data Parameter ↗
    2021-11-15 CVE-2021-24954 Improper Neutralization of Input During Web Page Generation Affects < 3.2.3 Patched in 3.2.3
50. Patched High · 7.2 Paid Membership, User Registration, User Profile & Restrict Content Plugin – ProfilePress <= 3.1.10 - Unauthenticated Cross-Site Scripting ↗
    2021-08-09 CVE-2021-24522 Improper Neutralization of Input During Web Page Generation Affects <= 3.1.10 Patched in 3.1.11
51. Patched Critical · 9.8 ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload ↗
    2021-06-28 CVE-2021-34624 Unrestricted Upload of File with Dangerous Type Affects 3.0.0 - 3.1.3 Patched in 3.1.4
52. Patched Critical · 9.8 ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation ↗
    2021-06-28 CVE-2021-34622 Improper Privilege Management Affects 3.0.0 - 3.1.3 Patched in 3.1.4
53. Patched Medium · 5.5 ProfilePress <= 3.1.7 - Authenticated Stored Cross-Site Scripting ↗
    2021-06-28 CVE-2021-24450 Improper Neutralization of Input During Web Page Generation Affects < 3.1.8 Patched in 3.1.8
54. Patched Critical · 9.8 User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation ↗
    2021-06-28 CVE-2021-34623 Unrestricted Upload of File with Dangerous Type Affects 3.0.0 - 3.1.3 Patched in 3.1.4
55. Patched Critical · 9.8 User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation ↗
    2021-06-28 CVE-2021-34621 Improper Privilege Management Affects 3.0.0 - 3.1.3 Patched in 3.1.4

Translated into 35 languages, 6 at 90% or more

Plus 11 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2025-06-14 200K+ → 100K+ down after 651 days in tier
2. 2023-09-02 300K+ → 200K+ down after 462 days in tier
3. 2022-05-28 400K+ → 300K+ down after 707 days in tier
4. 2020-06-20 300K+ → 400K+ up after 811 days in tier
5. 2018-04-01 200K+ → 300K+ up after 790 days in tier
6. 2016-02-01 100K+ → 200K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content into a readme, a review or a deck. It updates itself.

ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content: 100K+ active installs, 3.1★ (938 reviews). Plugin Pulse (WP Mayor), as of 2026-11-01. https://plugins.wpmayor.com/plugin/wp-user-avatar