Paid Memberships Pro subscribers can store script in readonly profile fields
Paid Memberships Pro through 3.8.1 accepts user-field values submitted through a page containing [pmpro_member_profile_edit], including fields configured as readonly, and later outputs readonly values without escaping them. A Subscriber can submit script-bearing content under the site-specific readonly field name; the value is stored in the profile and executes when that field is displayed. The exact request endpoint and parameter name depend on the site's shortcode page and custom-field configuration. Version 3.8.2 restores field sanitization, prevents readonly fields from being saved from user requests, and escapes their displayed values.
- Component
- Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
- Affected
- <= 3.8.1
- Safe version
3.8.2- Published
- Jul 28, 2026
This CVE was published Jul 28, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update Paid Memberships Pro to 3.8.2 or later. Review readonly membership-profile field values for unexpected markup, remove injected content, and investigate privileged users who viewed affected profiles.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Readonly User Field via [pmpro_member_profile_edit] Shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N