What’s Vulnerable › Products
Paid Memberships Pro vulnerabilities
26 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 2 published in the last 12 months.
Check whether your Paid Memberships Pro version is affected
Latest Paid Memberships Pro vulnerabilities
- CVE-2026-15016 — Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions <= 3.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4)
- CVE-2026-4100 — Paid Memberships Pro <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption (CVSS 7.1)
- CVE-2024-37277 — WordPress Paid Memberships Pro plugin <= 3.0.4 - Insecure Direct Object References (IDOR) vulnerability (CVSS 9.8)
- CVE-2024-1287 — Paid Memberships Pro - Member Directory Add On < 1.2.6 - Contributor+ Sensitive Information Disclosure via SQLi (CVSS 6.5)
- CVE-2024-1286 — Paid Memberships Pro - Membership Maps Add On < 0.7 - Contributor+ Sensitive Information Disclosure (CVSS 4.9)
- CVE-2024-37486 — WordPress Paid Memberships Pro plugin <= 3.0.5 - Authenticated SQL Injection vulnerability (CVSS 7.2)
- CVE-2023-39990 — WordPress Paid Memberships Pro plugin <= 1.2.3 - Broken Access Control vulnerability (CVSS 8.8)
- CVE-2024-1407 — Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery to Membership Modification (CVSS 5.4)
- CVE-2024-3215 — Paid Memberships Pro <= 3.0.1 - Cross-Site Request Forgery (CVSS 4.3)
- CVE-2024-32794 — WordPress Paid Memberships Pro plugin <= 2.12.10 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8)
- CVE-2024-32793 — WordPress Paid Memberships Pro plugin <= 2.12.10 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8)
- CVE-2024-0588 — Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery (CVSS 4.3)
- CVE-2024-1279 — Paid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field Disclosure (CVSS 4.3)
- CVE-2024-0624 — Paid Memberships Pro <= 2.12.7 - Cross-Site Request Forgery to Level Orders Update (CVSS 5.3)
- CVE-2023-6855 — Paid Memberships Pro <= 2.12.5 - Missing Authorization via API (CVSS 5.3)
- CVE-2023-6187 — Paid Memberships Pro <= 2.12.3 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8)
- CVE-2020-36754 — Paid Memberships Pro <= 2.4.2 - Cross-Site Request Forgery Bypass (CVSS 4.3)
- CVE-2023-0631 — Paid Memberships Pro < 2.9.12 - Subscriber+ SQL Injection (CVSS 8.8)
- CVE-2022-4830 — Paid Memberships Pro < 2.9.9 - Contributor+ Stored XSS via Shortcode (CVSS 5.4)
- CVE-2023-23488 — (CVSS 9.8)
- CVE-2021-25114 — Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL Injection (CVSS 9.8)
- CVE-2021-24979 — Paid Memberships Pro < 2.6.6 - Reflected Cross-Site Scripting (CVSS 6.1)
- CVE-2021-20678 — (CVSS 8.8)
- CVE-2020-5579 — (CVSS 7.2)
- CVE-2015-5532 — (CVSS 6.1)