GCVE - cpe:2.3:a:unknown:paid_memberships_pro:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:paid_memberships_pro:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unknown (`668ca391-a6cc-5e33-879b-83885214de33`)
Product	Paid Memberships Pro (`9628e09f-fdad-5e66-952e-6d6453ae24ba`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-1279`	vulnerable	2026-06-08 06:25:39.721333	Paid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field Disclosure The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users' sensitive metadata. Published: 2024-03-11T17:56:06.781Z Updated: 2025-03-28T18:33:06.391Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/4c537264-0c23-428e-9a11-7a9e74fb6b69/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-0631`	vulnerable	2026-06-08 05:52:32.108260	Paid Memberships Pro < 2.9.12 - Subscriber+ SQL Injection The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL query. Published: 2023-03-20T15:52:10.755Z Updated: 2025-02-26T14:44:50.619Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/19ef92fd-b493-4488-91f0-e6ba51362f79	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-4830`	vulnerable	2026-06-08 05:52:00.442809	Paid Memberships Pro < 2.9.9 - Contributor+ Stored XSS via Shortcode The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Published: 2023-02-13T14:32:30.964Z Updated: 2024-10-01T15:49:46.789Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/ae103336-a411-4ebf-a5f0-2f35701e364c	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-25114`	vulnerable	2026-06-08 05:30:39.989479	Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL Injection The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection Published: 2022-02-07T15:47:24.000Z Updated: 2024-08-03T19:56:10.572Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/6c25a5f0-a137-4ea5-9422-8ae393d7b76b https://www.paidmembershipspro.com/pmpro-update-2-6-7-security-release/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-24979`	vulnerable	2026-06-08 05:30:39.738347	Paid Memberships Pro < 2.6.6 - Reflected Cross-Site Scripting The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting Published: 2021-12-27T10:33:22.000Z Updated: 2024-08-03T19:49:14.417Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/fc011990-4ec1-4553-901d-4ff1f482cb79 https://plugins.trac.wordpress.org/changeset/2632369/paid-memberships-pro/tags/2.6.6/adminpages/discountcodes.php	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.