Plugin icon

Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions

paid-memberships-pro
Plugin closed

Vulnerabilities:

27

Last Updated:

October 12, 2024

Active Installs:

90000

Published
Title
Fixed in
CVSS
Published
2026-05-01
Title
Paid Memberships Pro < 3.6.6 - Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption
Fixed in
Fixed in 3.6.6
CVSS
7.1 (high)
Published
2024-07-04
Title
Paid Memberships Pro < 3.0.6 - Authenticated (Administrator+) SQL Injection
Fixed in
Fixed in 3.0.6
CVSS
9.1 (critical)
Published
2024-06-28
Title
Paid Memberships Pro < 3.0.5 - Unauthenticated Insecure Direct Object Reference to Order Status Update
Fixed in
Fixed in 3.0.5
CVSS
5.3 (medium)
Published
2024-06-18
Title
Paid Memberships Pro < 3.0 - Cross-Site Request Forgery to Membership Modification
Fixed in
Fixed in 3.0
CVSS
5.4 (medium)
Published
2024-04-15
Title
Paid Memberships Pro < 3.0.2 - Cross-Site Request Forgery
Fixed in
Fixed in 3.0.2
CVSS
5.3 (medium)
Published
2024-03-25
Title
Paid Memberships Pro < 3.0 - Cross-Site Request Forgery
Fixed in
Fixed in 3.0
CVSS
4.3 (medium)
Published
2024-02-16
Title
Paid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field Disclosure
Fixed in
Fixed in 2.12.9
CVSS
4.9 (medium)
Published
2024-01-24
Title
Paid Memberships Pro < 2.12.8 - Cross-Site Request Forgery
Fixed in
Fixed in 2.12.8
CVSS
5.3 (medium)
Published
2024-01-12
Title
Paid Memberships Pro < 2.12.7 - Information Exposure in Debug Logs
Fixed in
Fixed in 2.12.7
CVSS
5.3 (medium)
Published
2023-12-21
Title
Paid Memberships Pro < 2.12.6 - Missing Authorization via API
Fixed in
Fixed in 2.12.6
CVSS
5.3 (medium)
Published
2023-11-16
Title
Paid Memberships Pro < 2.12.4 - Subscriber+ Arbitrary File Upload
Fixed in
Fixed in 2.12.4
CVSS
7.5 (high)
Published
2023-02-27
Title
Paid Memberships Pro < 2.9.12 - Subscriber+ SQL Injection
Fixed in
Fixed in 2.9.12
CVSS
7.7 (high)
Published
2023-01-27
Title
Paid Memberships Pro < 2.9.9 - Contributor+ Stored XSS via Shortcode
Fixed in
Fixed in 2.9.9
CVSS
6.8 (medium)
Published
2023-01-12
Title
Paid Membership Pro < 2.9.8 - Unauthenticated SQLi
Fixed in
Fixed in 2.9.8
CVSS
8.6 (high)
Published
2022-01-07
Title
Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL Injection
Fixed in
Fixed in 2.6.7
CVSS
10.0 (critical)
Published
2021-11-23
Title
Paid Memberships Pro < 2.6.6 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.6.6
CVSS
8.8 (high)
Published
2021-06-25
Title
Paid Membership Pro < 2.5.10 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.5.10
CVSS
4.8 (medium)
Published
2021-03-17
Title
Paid Membership Pro < 2.5.6 - Authenticated SQL Injection
Fixed in
Fixed in 2.5.6
CVSS
6.3 (medium)
Published
2021-02-06
Title
Paid Membership Pro < 2.5.3 - Unauthorised Order Information Disclosure
Fixed in
Fixed in 2.5.3
CVSS
6.5 (medium)
Published
2020-11-16
Title
Paid Memberships Pro < 2.5.1 - Authenticated Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.5.1
CVSS
4.8 (medium)
Published
2020-09-16
Title
Paid Memberships Pro < 2.4.3 - Arbitrary Settings Update via CSRF
Fixed in
Fixed in 2.4.3
CVSS
4.3 (medium)
Published
2020-09-16
Title
Multiple Plugins/Themes - Cross-Site Request Forgery (CSRF)
Fixed in
Fixed in 2.4.3
CVSS
5.4 (medium)
Published
2020-05-19
Title
Paid Memberships Pro < 2.3.3 - Authenticated SQL Injection
Fixed in
Fixed in 2.3.3
CVSS
4.7 (medium)
Published
2019-06-01
Title
Paid Memberships Pro <= 2.0.5 - Authenticated Open Redirect
Fixed in
Fixed in 2.0.6
CVSS
n/a
Published
2015-07-22
Title
Paid Memberships Pro 1.8.4.2 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.8.4.3
CVSS
6.1 (medium)
Published
2014-11-19
Title
Paid Memberships Pro 1.7.14.2 - Path Traversal
Fixed in
Fixed in 1.7.15
CVSS
n/a
Published
2014-08-01
Title
Paid Memberships Pro 1.4.7 - adminpages/memberslist-csv.php Direct Request Member Personal Information Disclosure
Fixed in
Fixed in 1.5
CVSS
n/a