WordPress security by component
Paid Member Subscriptions
Plugin description
Paid Member Subscriptions is a WordPress component with 13 published CVE records in this archive. The latest tracked vulnerability was published Jul 27, 2026; the highest CVE/CNA score is 7.5.
Plugin slug:
paid-member-subscriptionsLatest vulnerability
CVE-2026-59539: Paid Member Subscriptions permits subscriber-level object access
Paid Member Subscriptions through 3.0.7 lets a Subscriber replace an object identifier in an undisclosed request without an adequate ownership check. This permits access to or modification of another user's protected object. The Patchstack CNA record does not disclose the endpoint, action, identifier parameter, object type, function or whether the operation reads or changes data.
| Safe version |
|
||
|---|---|---|---|
| Jul 27, 2026 |
CVE-2026-59539
Paid Member Subscriptions permits subscriber-level object access
Paid Member Subscriptions through 3.0.7 lets a Subscriber replace an object identifier in an undisclosed request without an adequate ownership check. This permits access to or modification of another user's protected object. The Patchstack CNA record does not disclose the endpoint, action, identifier parameter, object type, function or whether the operation reads or changes data.
|
3.0.8 |
CVE7.5
NVDPending
|
| Jul 02, 2026 |
CVE-2026-57348
Paid Member Subscriptions: Server-side request forgery
Paid Member Subscriptions is affected by server-side request forgery. The vulnerable path is reachable without authentication. The vulnerable server can be induced to make attacker-selected network requests. The published affected range is n/a through 3.0.4.
|
3.0.5 |
CVE7.2
NVDPending
|
| Jun 15, 2026 |
CVE-2026-39514
Paid Member Subscriptions: Cross-site scripting
Paid Member Subscriptions is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 2.17.3.
|
3.0.0 |
CVE7.1
NVDPending
|
| Feb 20, 2026 |
CVE-2025-68514
Paid Member Subscriptions: A security weakness
Paid Member Subscriptions is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE6.5
NVDPending
|
| Sep 03, 2025 |
CVE-2025-58600
Paid Member Subscriptions: A security weakness
Paid Member Subscriptions is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Aug 20, 2025 |
CVE-2025-54017
Paid Member Subscriptions: Filesystem traversal
Paid Member Subscriptions is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE7.5
NVDPending
|
| Jul 04, 2025 |
CVE-2025-49870
Paid Member Subscriptions: SQL injection
Paid Member Subscriptions is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE7.5
NVDPending
|
| Mar 28, 2025 |
CVE-2025-31088
Paid Member Subscriptions: Cross-site scripting
Paid Member Subscriptions is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVDPending
|
| Oct 02, 2024 |
CVE-2024-9222
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: Cross-site scripting
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVDPending
|
| Apr 24, 2024 |
CVE-2024-32728
Paid Member Subscriptions: Cross-site request forgery
Paid Member Subscriptions is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Mar 15, 2024 |
CVE-2023-51522
Paid Member Subscriptions: Cross-site request forgery
Paid Member Subscriptions is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE4.3
NVD8.8
|
| Feb 29, 2024 |
CVE-2024-1390
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: A security weakness
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Feb 29, 2024 |
CVE-2024-1389
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: A security weakness
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|