Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2024-30514

WordPress Paid Memberships Pro – Payfast Gateway Add On plugin <= 1.4.1 - Sensitive Data Exposure via Log File vulnerability

Insertion of Sensitive Information into Log File vulnerability in Paid Memberships Pro Paid Memberships Pro – Payfast Gateway Add On.This issue affects Paid Memberships Pro – Payfast Gateway Add On: from n/a through 1.4.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Paidmembershipspro
Products
Paid Memberships Pro
CVE-2024-1286

Paid Memberships Pro - Membership Maps Add On < 0.7 - Contributor+ Sensitive Information Disclosure

The pmpro-membership-maps WordPress plugin before 0.7 does not prevent users with at least the contributor role from leaking sensitive information about users with a membership on the site.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Paidmembershipspro Strangerstudios
Products
Maps Paid Memberships Pro
CVE-2024-1287

Paid Memberships Pro - Member Directory Add On < 1.2.6 - Contributor+ Sensitive Information Disclosure via SQLi

The pmpro-member-directory WordPress plugin before 1.2.6 does not prevent users with at least the contributor role from leaking other users' sensitive information, including password hashes via an SQLi vector.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Paidmembershipspro Strangerstudios
Products
Paid Memberships Pro Paid Memberships Pro
CVE-2022-4831

Custom User Profile Fields for User Registration & Member Frontend Profiles with Paid Memberships Pro < 1.8.1 - Contributor+ Stored XSS via Shortcode

The Custom User Profile Fields for User Registration WordPress plugin before 1.8.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Paidmembershipspro
Products
Custom User Profile Fields For User Registration
CVE-2024-37277

WordPress Paid Memberships Pro plugin <= 3.0.4 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Paid Memberships Pro: from n/a through 3.0.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Paidmembershipspro Strangerstudios
Products
Paid Memberships Pro Paid Memberships Pro