Paid Memberships Pro Security Vulnerabilities and Issues — Paid Memberships Pro CVE List

Lucene search

StrangerstudiosPaid Memberships Pro

5 matches found

CVE•added 2021/12/27 11:15 a.m.•59 views

CVE-2021-24979

The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting

6.1CVSS6AI score0.0269EPSS

CVE•added 2023/02/13 3:15 p.m.•56 views

CVE-2022-4830

The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high pri...

6.1CVSS5.2AI score0.18458EPSS

CVE•added 2017/10/23 6:29 p.m.•43 views

CVE-2015-5532

Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to membershiplevels.php, (2) memberslist.php, or (3) orders.php in adminpages/ or the (4)...

6.1CVSS6.1AI score0.01286EPSS

CVE•added 2024/07/30 6:15 a.m.•43 views

CVE-2024-1286

The pmpro-membership-maps WordPress plugin before 0.7 does not prevent users with at least the contributor role from leaking sensitive information about users with a membership on the site.

6.5CVSS6.1AI score0.00112EPSS

CVE•added 2024/07/30 6:15 a.m.•40 views

CVE-2024-1287

The pmpro-member-directory WordPress plugin before 1.2.6 does not prevent users with at least the contributor role from leaking other users' sensitive information, including password hashes.

6.5CVSS6.6AI score0.00088EPSS