Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2026-14848

Paid Member Subscriptions < 3.0.8 - Subscriber+ Cross-User Subscription Hijack via process_checkout

The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user, allowing any authenticated user with Subscriber-level access and above to take over another member's subscription and overwrite its plan, status and expiration.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Cozmoslabs Wordpress
Products
Paid Membership Subscriptions Wordpress
CVE-2026-14847

Paid Member Subscriptions < 3.0.7 - Subscriber+ Payment Data Disclosure via IDOR

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowing any authenticated user with Subscriber-level access and above to disclose the payment details of any member by enumerating the payment identifier.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cozmoslabs Wordpress
Products
Paid Membership Subscriptions Wordpress
CVE-2023-51522

WordPress Paid Membership Subscriptions plugin <= 2.10.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Paid Member Subscriptions.This issue affects Paid Member Subscriptions: from n/a through 2.10.4.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cozmoslabs
Products
Paid Membership Subscriptions
CVE-2025-11835

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.16.4 - Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewal

The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability and validation check on the PMS_AJAX_Checkout_Handler::process_payment() function in all versions up to, and including, 2.16.4. This makes it possible for unauthenticated attackers to trigger stored auto-renew charges for arbitrary members.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cozmoslabs Wordpress
Products
Paid Membership Subscriptions Wordpress
CVE-2024-1389

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via pms_stripe_connect_handle_authorization_return

The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pms_stripe_connect_handle_authorization_return function in all versions up to, and including, 2.11.1. This makes it possible for unauthenticated attackers to change the Stripe payment keys.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cozmoslabs Iovamihai
Products
Membership \& Content Restriction - Paid Member Subscriptions Paid Membership Subscriptions Effortless Memberships Recurring Payments And Content Restriction
CVE-2024-9222

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.12.8 - Reflected Cross-Site Scripting

The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.12.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Cozmoslabs Iovamihai
Products
Membership \& Content Restriction - Paid Member Subscriptions Paid Membership Subscriptions Effortless Memberships Recurring Payments And Content Restriction