WordPress Plugin Vulnerabilities

Paid Member Subscriptions < 2.4.2 - Reflected Cross-Site Scripting (XSS)

Description

The plugin was vulnerable to a Reflected Cross-Site Scripting (XSS) on the edit member page.

No CSRF nonce was required.

Proof of Concept

Affects Plugins

Plugin icon
paid-member-subscriptions
Fixed in 2.4.2

References

URL
https://plugins.trac.wordpress.org/changeset/2566399/paid-member-subscriptions

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Verified
Yes
WPVDB ID
a6fef63c-d588-4431-b06f-72d1fa25b2f7

Timeline

Publicly Published
2021-07-26 (about 4 years ago)
Added
2021-07-26 (about 4 years ago)
Last Updated
2021-07-26 (about 4 years ago)

Other

Published
Title
Published
2025-04-20
Title
Boxers and Swipers <= 4.02 - Author+ Stored XSS
Published
2024-02-23
Title
Brizy – Page Builder < 2.4.41 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-04-16
Title
Essential Addons for Elementor < 6.1.10 - Contributor+ Stored XSS
Published
2021-03-01
Title
WP GDPR Compliance < 1.5.6 - Unauthenticated Stored Cross-Site Scripting (XSS)
Published
2025-03-03
Title
AFI < 1.100.0 - Admin+ Stored XSS