VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction security & vulnerabilities

paid-member-subscriptions— active installsLast vulnerability Nov 7, 2026

No known unpatched vulnerabilities in the latest version

All 31 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
31Known vulnerabilities
  • Critical1
  • High5
  • Medium25
  • Low0
Vulnerabilities per year
2021: 2 vulnerabilities2212023: 1 vulnerability1232024: 6 vulnerabilities6242025: 7 vulnerabilities7252026: 15 vulnerabilities1526

All Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction vulnerabilities

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction vulnerabilities
SeverityVulnerabilityCVEPublished
Medium5.3Missing Authorization
≤3.1.3Update to 3.1.4
CVE-2026-119523
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.1.3Update to 3.1.4
CVE-2026-119521
Medium5.3Missing Authorization
≤3.1.2Update to 3.1.3
CVE-2026-112842
Medium6.5Authenticated (Subscriber+) SQL Injection
≤3.1.1Update to 3.1.2
CVE-2026-105317
Medium5.3Unauthenticated Unauthorized Subscription Activation
≤3.0.9Update to 3.1.0
CVE-2026-97249
Medium5.3Missing Authorization
≤3.0.0Update to 3.1.0
CVE-2026-90951
Medium5.3Unauthenticated CAPTCHA Bypass
≤3.0.0Update to 3.1.0
CVE-2026-90950
Medium5.3Unauthenticated Payment Bypass
≤3.0.8Update to 3.0.9
CVE-2026-90922
Medium4.3Missing Authorization to Authenticated (Subscriber+) Cross-User Subscription Hijack
≤3.0.7Update to 3.0.8
CVE-2026-14848
Medium4.3Insecure Direct Object Reference
≤3.0.7Update to 3.0.8
CVE-2026-59539
Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Payment Data Disclosure
≤3.0.6Update to 3.0.7
CVE-2026-14847
Medium5.3Unauthenticated Information Exposure
≤3.0.6Update to 3.0.7
CVE-2026-14849
Medium6.1Unauthenticated Server-Side Request Forgery
≤3.0.4Update to 3.0.5
CVE-2026-57348
Medium6.1Reflected Cross-Site Scripting
≤2.17.3Update to 3.0.0
CVE-2026-39514
Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
≤2.16.8Update to 2.16.9
CVE-2025-68514
Medium5.3Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewal
≤2.16.4Update to 2.16.5
CVE-2025-11835
Medium5.3Missing Authorization
≤2.15.9Update to 2.16.0
CVE-2025-58600
High8.1Unauthenticated Local File Inclusion
≤2.15.4Update to 2.15.5
CVE-2025-54017
High8.1Unauthenticated Local File Inclusion
≤2.15.4Update to 2.15.5
—
High7.5Unauthenticated SQL Injection
≤2.15.1Update to 2.15.2
CVE-2025-49870
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.14.3Update to 2.14.4
CVE-2025-31088
Critical9.8Authentication Bypass via pms_payment_id
≤2.13.7Update to 2.13.8
CVE-2024-12919
Medium5.3Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
≤2.13.4Update to 2.13.5
CVE-2024-11291
High7.3Unauthenticated Arbitrary Shortcode Execution
≤2.13.0Update to 2.13.1
CVE-2024-10261
Medium6.1Reflected Cross-Site Scripting
≤2.12.8Update to 2.12.9
CVE-2024-9222
Medium4.3Cross-Site Request Forgery to Notice Dismissal
≤2.11.0Update to 2.11.1
CVE-2024-32728
Medium5.3Missing Authorization via pms_stripe_connect_handle_authorization_return
≤2.11.1Update to 2.11.2
CVE-2024-1389
Medium4.3Missing Authorization via creating_pricing_table_page
≤2.11.1Update to 2.11.2
CVE-2024-1390
Medium4.3Cross-Site Request Forgery via ajax_add_log_entry
≤2.10.4Update to 2.10.5
CVE-2023-51522
Medium6.1Reflected Cross-Site Scripting
<2.4.2Update to 2.4.2
—
High8.8SQL Injection
≤2.4.1Update to 2.4.2
CVE-2021-24728

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: common questions

Does Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction have known vulnerabilities?

Yes. VulnCrest Radar lists 31 known vulnerabilities in Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: 1 critical, 5 high, 25 medium. None are known to affect version null.

How do I check which version of Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction vulnerability?

CVE-2026-119523, published Nov 7, 2026: Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.3 - Missing Authorization. Severity: Medium (CVSS 5.3).

Is any Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction vulnerability listed in CISA KEV?

No. None of the known Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?