Paid Member Subscriptions < 2.10.5 - Cross-Site Request Forgery via ajax_add_log_entry

Description The Paid Member Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.10.4. This is due to missing or incorrect nonce validation on the ajaxaddlogentry function. This makes it possible for unauthenticated attackers to modify...

WordPress Paid Member Subscriptions Plugin <= 2.10.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Paid Member Subscriptions Type Plugin Vulnerable versions = 2.10.4 Fixed in 2.10.5 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-51522 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 89f9209574c0 Credits Brandon...

CVE-2021-24728

The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages...

CVE-2021-24728

The CVE-2021-24728 issue affects the WordPress plugin Membership & Content Restriction – Paid Member Subscriptions, specifically versions before 2.4.2. The root cause is that the plugin does not sanitise, validate, or escape the order and orderby parameters before using them in SQL statements, re...

WordPress plugin Membership & Content Restriction – Paid Member Subscriptions SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

Paid Member Subscriptions < 2.4.2 - Authenticated SQL Injection

The plugin did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages. http://www.example.com/wp-admin/admin.php?page=pms-members-page&orderby=userid&order=asc,select from...

Paid Member Subscriptions < 2.4.2 - Authenticated SQL Injection

The plugin did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages. PoC http://www.example.com/wp-admin/admin.php?page=pms-members-page=userid=asc,select from selectsleep10a...

WordPress Paid Member Subscriptions plugin <= 2.4.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered in WordPress Paid Member Subscriptions plugin versions = 2.4.1. Solution Update the WordPress Paid Member Subscriptions plugin to the latest available version at least 2.4.2...