Advisories · Technology

PeproDev Ultimate Profile Solutions.

Every CVE that names PeproDev Ultimate Profile Solutions among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-4791 CVE record

CVSS 6.4 Medium

PeproDev Ultimate Profile Solutions <= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute
- PeproDev Ultimate Profile Solutions
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2025-3921 CVE record

CVSS 8.2 High

PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Limited Unauthenticated Arbitrary User Meta Update via handel_ajax_req Function
- PeproDev Ultimate Profile Solutions
- Broken access control
Not analysed yet 7 May 2025
CVE-2025-3924 CVE record

CVSS 5.3 Medium

PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Unauthenticated Email Enumeration
- PeproDev Ultimate Profile Solutions
- Broken access control
Not analysed yet 7 May 2025
CVE-2025-3844 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Authentication Bypass to Account Takeover
- PeproDev Ultimate Profile Solutions
- Authentication bypass
Not analysed yet 7 May 2025