Plugin icon

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction

paid-member-subscriptions

Vulnerabilities:

27

Last Updated:

October 5, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-10-05
Title
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction < 3.1.2 - Authenticated (Subscriber+) SQL Injection
Fixed in
Fixed in 3.1.2
CVSS
6.5 (medium)
Published
2026-09-28
Title
Paid Member Subscriptions < 3.1.0 - Unauthenticated Subscription Activation via Stripe SCA Resume AJAX Endpoint
Fixed in
Fixed in 3.1.0
CVSS
5.3 (medium)
Published
2026-09-21
Title
Paid Member Subscriptions < 3.1.0 - Unauthenticated reCAPTCHA Bypass via Registration Form
Fixed in
Fixed in 3.1.0
CVSS
5.3 (medium)
Published
2026-09-21
Title
Paid Member Subscriptions < 3.1.0 - Unauthenticated In-Flight Checkout State Deletion via pms_process_payment
Fixed in
Fixed in 3.1.0
CVSS
3.7 (low)
Published
2026-09-15
Title
Paid Member Subscriptions < 3.0.9 - Unauthenticated Membership Payment Bypass via PayPal Standard Amount and Currency Mismatch
Fixed in
Fixed in 3.0.9
CVSS
5.3 (medium)
Published
2026-07-27
Title
Paid Member Subscriptions < 3.0.8 - Subscriber+ Cross-User Subscription Hijack via process_checkout
Fixed in
Fixed in 3.0.8
CVSS
5.4 (medium)
Published
2026-07-23
Title
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction < 3.0.8 - Insecure Direct Object Reference
Fixed in
Fixed in 3.0.8
CVSS
4.3 (medium)
Published
2026-07-13
Title
Paid Member Subscriptions < 3.0.7 - Unauthenticated Sensitive Information Exposure via Residual Export Files
Fixed in
Fixed in 3.0.7
CVSS
3.7 (low)
Published
2026-07-13
Title
Paid Member Subscriptions < 3.0.7 - Subscriber+ Payment Data Disclosure via IDOR
Fixed in
Fixed in 3.0.7
CVSS
4.3 (medium)
Published
2026-07-01
Title
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction < 3.0.5 - Unauthenticated Server-Side Request Forgery
Fixed in
Fixed in 3.0.5
CVSS
6.1 (medium)
Published
2026-04-20
Title
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction < 3.0.0 - Reflected Cross-Site Scripting
Fixed in
Fixed in 3.0.0
CVSS
6.1 (medium)
Published
2026-02-11
Title
Paid Member Subscriptions < 2.16.9 - Authenticated (Subscriber+) Insecure Direct Object Reference
Fixed in
Fixed in 2.16.9
CVSS
4.3 (medium)
Published
2025-11-04
Title
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction < 2.16.5 - Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewal
Fixed in
Fixed in 2.16.5
CVSS
5.3 (medium)
Published
2025-09-03
Title
Paid Member Subscriptions < 2.16.0 - Missing Authorization
Fixed in
Fixed in 2.16.0
CVSS
5.3 (medium)
Published
2025-07-29
Title
Paid Membership Subscriptions < 2.15.5 - Unauthenticated Local File Inclusion
Fixed in
Fixed in 2.15.5
CVSS
8.1 (high)
Published
2025-07-03
Title
Paid Member Subscriptions < 2.15.2 - Unauthenticated SQL Injection
Fixed in
Fixed in 2.15.2
CVSS
7.5 (high)
Published
2025-03-28
Title
Paid Member Subscriptions < 2.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.14.4
CVSS
6.4 (medium)
Published
2025-01-13
Title
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction < 2.13.8 - Authentication Bypass via pms_payment_id
Fixed in
Fixed in 2.13.8
CVSS
9.8 (critical)
Published
2024-12-17
Title
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction < 2.13.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
Fixed in
Fixed in 2.13.5
CVSS
5.3 (medium)
Published
2024-11-08
Title
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction < 2.13.1 - Unauthenticated Arbitrary Shortcode Execution
Fixed in
Fixed in 2.13.1
CVSS
7.3 (high)
Published
2024-10-01
Title
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction < 2.12.9 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.12.9
CVSS
6.1 (medium)
Published
2024-04-22
Title
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction < 2.11.1 - Cross-Site Request Forgery to Notice Dismissal
Fixed in
Fixed in 2.11.1
CVSS
4.3 (medium)
Published
2024-02-13
Title
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction < 2.11.2 - Missing Authorization via pms_stripe_connect_handle_authorization_return
Fixed in
Fixed in 2.11.2
CVSS
5.3 (medium)
Published
2024-02-13
Title
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction < 2.11.2 - Missing Authorization via creating_pricing_table_page
Fixed in
Fixed in 2.11.2
CVSS
4.3 (medium)
Published
2023-12-27
Title
Paid Member Subscriptions < 2.10.5 - Cross-Site Request Forgery via ajax_add_log_entry
Fixed in
Fixed in 2.10.5
CVSS
4.3 (medium)
Published
2021-08-06
Title
Paid Member Subscriptions < 2.4.2 - Authenticated SQL Injection
Fixed in
Fixed in 2.4.2
CVSS
6.5 (medium)
Published
2021-07-26
Title
Paid Member Subscriptions < 2.4.2 - Reflected Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.4.2
CVSS
7.1 (high)