Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions

Explore Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions vulnerabilities across all versions. Currently tracking 28 known vulnerabilities, including severity, impact, and patch status.

01234567891014.11.2014Today14.11.20147.5Paid Memberships Pro < 1.7.15 - Directory Traversal CVSS 7.5 · 14.11.201422.07.20156.1Paid Memberships Pro < 1.8.4.3 - Multiple Cross-Site Scripting CVSS 6.1 · 22.07.201501.06.20197.2Paid Memberships Pro <= 2.0.5 - Open Redirect CVSS 7.2 · 01.06.201919.05.20204.7Paid Memberships Pro < 2.3.3 - Authenticated SQL Injection CVSS 4.7 · 19.05.202016.09.20204.3Paid Memberships Pro <= 2.4.2 - Cross-Site Request Forgery Bypass CVSS 4.3 · 16.09.202016.11.20206.4Paid Memberships Pro <= 2.5.0 - Cross-Site Scripting CVSS 6.4 · 16.11.202006.01.20214.3Paid Memberships Pro – Restrict Member Access to Content, Courses, Communities – Free or Paid Subscriptions <= 2.5.2 - IDOR to Sensitive Information Disclosure CVSS 4.3 · 06.01.202105.03.20218.8Paid Memberships Pro <= 2.5.5 - Authenticated SQL Injection CVSS 8.8 · 05.03.202125.06.20216.4Paid Memberships Pro – Restrict Member Access to Content, Courses, Communities – Free or Paid Subscriptions <= 2.5.9.1 - Cross-Site Scripting CVSS 6.4 · 25.06.202123.11.20216.1Paid Memberships Pro <= 2.6.5 - Reflected Cross-Site Scripting CVSS 6.1 · 23.11.202107.01.20229.8Paid Memberships Pro <= 2.6.6 - Unauthenticated SQL Injection CVSS 9.8 · 07.01.202212.01.20239.8Paid Memberships Pro < 2.9.8 - Unauthenticated SQL Injection CVSS 9.8 · 12.01.202323.01.20236.4Paid Memberships Pro <= 2.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 6.4 · 23.01.202328.02.20237.7Paid Memberships Pro <= 2.9.11 - Authenticated (Subscriber+) SQL Injection via Shortcodes CVSS 7.7 · 28.02.202316.11.20237.5Paid Memberships Pro <= 2.12.3 - Authenticated (Subscriber+) Arbitrary File Upload CVSS 7.5 · 16.11.202321.12.20235.3Paid Memberships Pro <= 2.12.5 - Missing Authorization via API CVSS 5.3 · 21.12.202312.01.20245.3Paid Memberships Pro <= 2.12.6 - Information Exposure in Debug Logs CVSS 5.3 · 12.01.202424.01.20245.3Paid Memberships Pro <= 2.12.7 - Cross-Site Request Forgery to Level Orders Update CVSS 5.3 · 24.01.202408.02.20244.3Paid Memberships Pro <= 2.12.8 - Authenticated (Contributor+) User Meta Disclosure CVSS 4.3 · 08.02.202416.02.20244.3Paid Memberships Pro <= 2.12.8 - Authenticated (Contributor+) Information Disclosure via Shortcode CVSS 4.3 · 16.02.202425.03.20244.3Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery CVSS 4.3 · 25.03.202415.04.20245.3Paid Memberships Pro <= 3.0.1 - Cross-Site Request Forgery CVSS 5.3 · 15.04.202422.04.20245.4Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery CVSS 5.4 · 22.04.202418.06.20245.4Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery to Membership Modification CVSS 5.4 · 18.06.202428.06.20245.3Paid Memberships Pro <= 3.0.4 - Unauthenticated Insecure Direct Object Reference to Order Status Update CVSS 5.3 · 28.06.202404.07.20249.1Paid Memberships Pro <= 3.0.5 - Authenticated (Administrator+) SQL Injection CVSS 9.1 · 04.07.202401.05.20267.1Paid Memberships Pro <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption CVSS 7.1 · 01.05.202627.07.20266.4Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions <= 3.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVSS 6.4 · 27.07.2026

Strategic Overview

Avg CVSSMedium
6.3/ 10
Patch Coverage100%
Open

0

Fixed

28

Get automatic notifications for all Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions vulnerabilities before they are exploited.

Vulnerability Records

28 records
2026-07-27 23:51CVE-2026-15016
6.4
Medium
h0xiloYes
2026-05-01 00:00CVE-2026-4100
7.1
High
Jared ReyesYes
2024-07-04 00:00CVE-2024-37486
9.1
Critical
Trương Hữu Phúc (truonghuuphuc)Yes
2024-06-28 00:00CVE-2024-37277
5.3
Medium
Rafie MuhammadYes
2024-06-18 18:44CVE-2024-1407
5.4
Medium
Colin XuYes
2024-04-22 00:00CVE-2024-32793
5.4
Medium
Majed RefaeaYes
2024-04-15 00:00CVE-2024-3215
5.3
Medium
Whit TaylorYes
2024-03-25 00:00CVE-2024-0588
4.3
Medium
kodaichodaiYes
2024-02-16 00:00CVE-2024-1279
4.3
Medium
Scott Kingsley ClarkYes
2024-02-08 00:00N/A
4.3
Medium
Scott Kingsley ClarkYes
Showing 1–10 of 28 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C