CVE-2023-23488-pmpro-2.8

Dockerizing a Vulnerability: CVE-2023-23488 This project aims to dockerize a specific vulnerability using Docker. The goal is to create an isolated environment in which the vulnerability can be exploited and tested securely. Vulnerable Application Paid Memberships Pro v2.9.8 WordPress Plugin -...

WordPress Paid Memberships Pro <2.6.7 - Blind SQL Injection

WordPress Paid Memberships Pro plugin before 2.6.7 is susceptible to blind SQL injection. The plugin does not escape the discountcode in one of its REST routes before using it in a SQL statement. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized...

WordPress Paid Memberships Pro <2.9.8 - Blind SQL Injection

WordPress Paid Memberships Pro plugin before 2.9.8 contains a blind SQL injection vulnerability in the 'code' parameter of the /pmpro/v1/order REST route. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of th...

CVE-2023-23488-PoC

CVE-2023-23488-PoC Unauthenticated SQL Injection - Paid Memberships Pro 2.9.8 WordPress Plugin Running this script against a WordPress instance with Paid Membership Pro plugin tells you if the target is vulnerable. As the SQL injection technique required to exploit it is Time-based blind, instead...

CVE-2026-14848

The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user, allowing any authenticated user with Subscriber-level access and above to take over another member's...

WordPress Paid Memberships Pro plugin <= 3.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by h0xilo in WordPress Plugin Paid Memberships Pro versions = 3.8.1...

CVE-2026-15016

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Readonly User Field via pmpromemberprofileedit Shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization...

CVE-2026-15016

CVE-2026-15016 affects the Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions WordPress plugin. The vulnerability is a Stored Cross-Site Scripting issue in the Readonly User Field via the [pmpro_member_profile_edit] shortcode, exploitable in all versions up to and...

CVE-2026-15016

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Readonly User Field via pmpromemberprofileedit Shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization...

CVE-2026-15016 Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions <= 3.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Readonly User Field via pmpromemberprofileedit Shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization...

EUVD-2026-49789

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Readonly User Field via pmpromemberprofileedit Shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization...

PT-2026-65456

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Readonly User Field via pmpro member profile edit Shortcode in all versions up to, and including, 3.8.1 due to insufficient input...

CVE-2026-57659

Unauthenticated Cross Site Request Forgery CSRF in Paid Memberships Pro - Add Member From Admin = 0.7.2 versions...

CVE-2026-57659 WordPress Paid Memberships Pro - Add Member From Admin plugin <= 0.7.2 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Paid Memberships Pro - Add Member From Admin = 0.7.2 versions...

EUVD-2026-39664

Unauthenticated Cross Site Request Forgery CSRF in Paid Memberships Pro - Add Member From Admin = 0.7.2 versions...

CVE-2026-57659

CVE-2026-57659 describes an unauthenticated CSRF vulnerability in the WordPress plugin Paid Memberships Pro – Add Member From Admin (versions

CVE-2026-57659 WordPress Paid Memberships Pro - Add Member From Admin plugin <= 0.7.2 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Paid Memberships Pro - Add Member From Admin = 0.7.2 versions...

CVE-2026-57659

Unauthenticated Cross Site Request Forgery CSRF in Paid Memberships Pro - Add Member From Admin = 0.7.2 versions...

WordPress Paid Memberships Pro - Add Member From Admin plugin <= 0.7.2 - Cross Site Request Forgery (CSRF) vulnerability

WordPress Paid Memberships Pro - Add Member From Admin plugin = 0.7.2 - Cross Site Request Forgery CSRF vulnerability discovered by Roll in WordPress Plugin Paid Memberships Pro - Add Member From Admin versions = 0.7.2...

PT-2026-52829

Name of the Vulnerable Software and Affected Versions Paid Memberships Pro - Add Member From Admin versions prior to 0.7.3 Description An unauthenticated Cross Site Request Forgery CSRF exists, which allows attackers to execute unauthorized actions via crafted requests. CSRF is a type of attack...