Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price.

1. ★★★★★ 1question

   2mo ago

   Hi, Big thanks for this plugin : )

   Read on wp.org ↗
2. ★★★★★ jacobdreizin

   3mo ago

   My paywalled/subscription website crashed when ProfilePress pushed an update with a small error in the coding (in the part responsible for user avatar pics, of all things), but the support was very responsive, and resolved the problem on the same day, in fact within at most 5 hours of my first communication, which I was really not expecting. Thank you!

   Read on wp.org ↗
3. ★★★★★ mvxweb

   3mo ago

   The content restriction feature is straightforward and works reliably. Tested with different user accounts and membership levels, and access was always enforced correctly. No fuss. No confusing setup.

   Read on wp.org ↗
4. ★★★★★ Ryan

   4mo ago

   This is an excellent plug‑in. I’m surprised I haven’t heard about it before. Shockingly, it integrates with multiple prominent LMS platforms, including LearnDash, and the platform is very user‑friendly. So I feel I’ve got great value for money. I hope the developers or the owners keep updating and improving the plugin.

   Read on wp.org ↗
5. ★★★★★ negru13

   5mo ago

   This used to be WP User Avatar. Now is this bloated usless plugin. Not what I asked for.

   Read on wp.org ↗
6. ★★★★★ weswebmaster

   6mo ago

   We are working towards a new website, and the ProfilePress team have been extremely supportive in answering queries and even responding to feature requests. Great team! Thank you.

   Read on wp.org ↗
7. ★★★★★ chaney220

   7mo ago

   I was using Profile Press for a little bit but found that it just didn’t have all of the options that I needed for my customers’ profiles. I started using Ultimate Member, and it has many more features.

   Read on wp.org ↗
8. ★★★★★ devmickey

   7mo ago

   ​ I’ve been using ProfilePress for memberships and payments, and it has become a core part of my WordPress setup. It’s a powerful ecommerce and paid membership plugin that supports one-time and recurring payments, selling subscriptions, and restricting content behind a paywall with access to control rules. Their plugin is well documented, so everyone should be able to set it up. On top of that, it’s very flexible on the front end: you can build custom registration, login, password reset, and edit-profile forms using a drag-and-drop builder, and you can also create user profiles and member directories. What truly stands out is their team: fast responses, clear answers, and genuine willingness to think along and propose practical solutions. Special mention to Ibrahim and Collins who consistently go above and beyond with tailored fixes and implementations. They really do listen to their community and have a can-do mentality when it comes to changing the product to meet customer expectations. Overall, highly recommended for anyone building a membership site or selling digital products on WordPress. Good luck on the further development!

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 4.16.19 Add optional order creation to the Add New Customer screen. Fixed bug where suppressed email still went out. Fixed security issue where other file types (exe, msi) could be uploaded outside ProfilePress upload scope. Imp 4.16.19
2. — Version 4.16.18 Added compatibility with Yoast URL Cleanup feature. Fix security issue where non-admin user role can be passed as user role. 4.16.18
3. — Version 4.16.17 Fixed security issue a user subscription can be canceled by another user. 4.16.17
4. — Version 4.16.16 Pro: Paddle addon . Added password visibility icons to the password reset handler form fields 4.16.16
5. — Version 4.16.15 Pro: Brevo addon . Pro: Auto-Renewal Checkbox addon . Added filters to the test mode notice and checkout username. Added membership conditions to Elementor display rules. See the changelog file for full change log inform 4.16.15
6. — Version 4.17.0 Premium: Added Pay What You Want addon . Added Subscription Payment Failed email notification. Fixed Stripe bug where email change caused checkout failure. Fixed fatal error when price has a currency symbol or thousands 4.17.0

47 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 5.4 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field ↗
   2026-08-15 CVE-2026-18385 Improper Control of Generation of Code ('Code Injection') Affects <= 4.16.19 Patched in 4.17.0
2. High · 8.8 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion ↗
   2026-07-16 CVE-2026-13352 Unrestricted Upload of File with Dangerous Type Affects <= 4.16.18 Patched in 4.16.19
3. Critical · 9.8 ProfilePress <= 4.16.17 - Unauthenticated Privilege Escalation ↗
   2026-07-03 CVE-2026-12497 Improper Privilege Management Affects <= 4.16.17 Patched in 4.16.18
4. Medium · 4.3 ProfilePress <= 4.16.16 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation ↗
   2026-06-06 CVE-2026-10820 Authorization Bypass Through User-Controlled Key Affects <= 4.16.16 Patched in 4.16.17
5. Medium · 6.4 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
   2026-04-23 CVE-2026-41556 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.16.13 Patched in 4.16.14
6. Medium · 4.3 ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription ↗
   2026-04-15 CVE-2026-4949 Missing Authorization Affects <= 4.16.12 Patched in 4.16.13
7. Medium · 6.5 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields ↗
   2026-04-03 CVE-2026-3309 Improper Control of Generation of Code ('Code Injection') Affects <= 4.16.11 Patched in 4.16.12
8. High · 7.1 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass ↗
   2026-04-03 CVE-2026-3445 Missing Authorization Affects <= 4.16.11 Patched in 4.16.12
9. High · 8.1 ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration ↗
   2026-03-10 CVE-2026-3453 Authorization Bypass Through User-Controlled Key Affects <= 4.16.11 Patched in 4.16.12
10. Medium · 5.4 ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution ↗
    2025-12-08 CVE-2025-13642 Improper Control of Generation of Code ('Code Injection') Affects <= 4.16.7 Patched in 4.16.8
11. Medium · 6.5 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution ↗
    2025-08-15 CVE-2025-8878 Improper Control of Generation of Code ('Code Injection') Affects <= 4.16.4 Patched in 4.16.5
12. Medium · 4.4 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-01-23 CVE-2024-13120 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.15.19 Patched in 4.15.20
13. Medium · 4.4 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-01-23 CVE-2024-13121 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.15.19 Patched in 4.15.20
14. Medium · 4.4 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-01-23 CVE-2024-13119 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.15.19 Patched in 4.15.20
15. Medium · 5.3 ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure ↗
    2024-11-26 CVE-2024-11083 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 4.15.18 Patched in 4.15.19
16. Medium · 4.4 ProfilePress <= 4.15.14 - Authenticated (Admin+) Stored Cross-Site Scripting via "Labels" ↗
    2024-11-21 CVE-2024-10517 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.15.14 Patched in 4.15.15
17. Medium · 4.4 ProfilePress <= 4.15.14 - Authenticated (Admin+) Stored Cross-Site Scripting via "Product Files" ↗
    2024-11-21 CVE-2024-10518 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.15.14 Patched in 4.15.15
18. Medium · 6.4 ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget ↗
    2024-05-22 CVE-2024-2861 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.15.8 Patched in 4.15.9
19. Medium · 6.4 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.4 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-04-11 CVE-2024-2867 Improper Input Validation Affects <= 4.15.4 Patched in 4.15.5
20. Medium · 6.4 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'reg-single-checkbox' ↗
    2024-04-09 CVE-2024-3210 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.15.5 Patched in 4.15.6
21. Medium · 6.4 ProfilePress <= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2024-03-12 CVE-2024-1535 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.15.2 Patched in 4.15.3
22. Medium · 6.4 ProfilePress <= 4.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode ↗
    2024-02-23 CVE-2024-1806 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.15.1 Patched in 4.15.2
23. Medium · 6.4 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via [reg-select-role] Shortcode ↗
    2024-02-22 CVE-2024-1409 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.15.0 Patched in 4.15.1
24. Medium · 6.4 ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2024-02-19 CVE-2024-1570 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.14.4 Patched in 4.15.0
25. Medium · 6.5 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.4 - Unauthenticated Stored Cross-Site Scripting ↗
    2024-02-19 CVE-2024-1519 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.14.4 Patched in 4.15.0
26. Medium · 6.4 ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcode ↗
    2024-02-19 CVE-2024-1408 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.14.4 Patched in 4.15.0
27. Medium · 6.4 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-02-01 CVE-2024-1046 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.14.3 Patched in 4.14.4
28. Medium · 5.3 ProfilePress <= 4.13.2 - Information Disclosure via Debug Log ↗
    2023-10-02 CVE-2023-44150 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 4.13.2 Patched in 4.13.3
29. High · 7.3 ProfilePress <= 4.13.1 - Limited Privilege Escalation via 'acceptable_defined_roles' ↗
    2023-09-09 CVE-2023-41954 Improper Input Validation Affects < 4.13.2 Patched in 4.13.2
30. Medium · 4.3 ProfilePress <= 4.13.1 Cross-Site Request Forgery via 'admin_notice' ↗
    2023-09-09 CVE-2023-41953 Cross-Site Request Forgery (CSRF) Affects < 4.13.2 Patched in 4.13.2
31. Medium · 6.1 ProfilePress <= 4.10.3 - Reflected Cross-Site Scripting via error message ↗
    2023-06-23 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 4.11.0 Patched in 4.11.0
32. High · 7.2 ProfilePress <= 4.5.3 - Unauthenticated Cross-Site Scripting ↗
    2023-03-27 CVE-2022-47444 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.5.3 Patched in 4.5.4
33. High · 7.2 ProfilePress <= 4.5.4 - Unauthenticated Stored Cross-Site Scripting ↗
    2023-02-21 CVE-2023-23830 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.5.4 Patched in 4.5.5
34. Medium · 6.4 ProfilePress <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes ↗
    2023-02-20 CVE-2023-23820 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.5.4 Patched in 4.5.5
35. Medium · 5.5 ProfilePress <= 4.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2023-01-20 CVE-2023-23996 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.5.3 Patched in 4.5.4
36. Medium · 5.5 ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2022-12-23 CVE-2022-4697 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.5.0 Patched in 4.5.1
37. Medium · 5.5 ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form Settings ↗
    2022-12-23 CVE-2022-4698 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.5.0 Patched in 4.5.1
38. Medium · 6.6 ProfilePress <= 4.3.2 - Authenticated (Admin+) PHP Object Injection ↗
    2022-12-14 CVE-2022-45083 Deserialization of Untrusted Data Affects <= 4.3.2 Patched in 4.4.0
39. Medium · 6.1 WordPress Membership, User Registration, Login Form, User Profile & Restrict Content Plugin – ProfilePress <= 3.2.15 - Reflected Cross-Site Scripting ↗
    2022-07-22 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.2.15 Patched in 3.2.16
40. Medium · 6.1 ProfilePress <= 3.2.2 - Reflected Cross-Site Scripting ↗
    2021-11-15 CVE-2021-24955 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 3.2.3 Patched in 3.2.3
41. Medium · 6.1 ProfilePress <= 3.2.2 - Reflected Cross-Site Scripting via ppress_cc_data Parameter ↗
    2021-11-15 CVE-2021-24954 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 3.2.3 Patched in 3.2.3
42. High · 7.2 Paid Membership, User Registration, User Profile & Restrict Content Plugin – ProfilePress <= 3.1.10 - Unauthenticated Cross-Site Scripting ↗
    2021-08-09 CVE-2021-24522 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.1.10 Patched in 3.1.11
43. Critical · 9.8 ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload ↗
    2021-06-28 CVE-2021-34624 Unrestricted Upload of File with Dangerous Type Affects 3.0.0 - 3.1.3 Patched in 3.1.4
44. Critical · 9.8 ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation ↗
    2021-06-28 CVE-2021-34622 Improper Privilege Management Affects 3.0.0 - 3.1.3 Patched in 3.1.4
45. Medium · 5.5 ProfilePress <= 3.1.7 - Authenticated Stored Cross-Site Scripting ↗
    2021-06-28 CVE-2021-24450 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 3.1.8 Patched in 3.1.8
46. Critical · 9.8 User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation ↗
    2021-06-28 CVE-2021-34623 Unrestricted Upload of File with Dangerous Type Affects 3.0.0 - 3.1.3 Patched in 3.1.4
47. Critical · 9.8 User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation ↗
    2021-06-28 CVE-2021-34621 Improper Privilege Management Affects 3.0.0 - 3.1.3 Patched in 3.1.4

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 35 languages, 5 at 90% or more

Plus 11 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2025-06-14 200K+ → 100K+ down after 651 days in tier
2. 2023-09-02 300K+ → 200K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 200K+ installs · 4.4★ · 3 shared tags A
• User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 50K+ installs · 4.8★ · 3 shared tags A
• User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission 20K+ installs · 4.1★ · 3 shared tags A
• WP User Manager – User Profile Builder & Membership 10K+ installs · 4.7★ · 3 shared tags A
• User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor 40K+ installs · 4.7★ · 2 shared tags A
• Simple Membership 40K+ installs · 4.6★ · 2 shared tags A

Embed this report card

Drop a live Pulse card for Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress into a readme, a review or a deck. It updates itself.

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: 100K+ active installs, 3.1★ (937 reviews). Plugin Pulse (WP Mayor), as of 2026-08-26. https://plugins.wpmayor.com/plugin/wp-user-avatar