VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions security & vulnerabilities

paid-memberships-pro— active installsLast vulnerability Jul 27, 2026

No known unpatched vulnerabilities in the latest version

All 28 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
28Known vulnerabilities
  • Critical3
  • High6
  • Medium19
  • Low0
Vulnerabilities per year
2014: 1 vulnerability1142015: 1 vulnerability1152019: 1 vulnerability1192020: 3 vulnerabilities3202021: 4 vulnerabilities4212022: 1 vulnerability1222023: 5 vulnerabilities5232024: 10 vulnerabilities10242026: 2 vulnerabilities226

All Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions vulnerabilities

Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤3.8.1Update to 3.8.2
CVE-2026-15016
High7.1Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption
≤3.6.5Update to 3.6.6
CVE-2026-4100
Critical9.1Authenticated (Administrator+) SQL Injection
≤3.0.5Update to 3.0.6
CVE-2024-37486
Medium5.3Unauthenticated Insecure Direct Object Reference to Order Status Update
≤3.0.4Update to 3.0.5
CVE-2024-37277
Medium5.4Cross-Site Request Forgery to Membership Modification
≤2.12.10Update to 3.0
CVE-2024-1407
Medium5.4Cross-Site Request Forgery
≤2.12.10Update to 3.0
CVE-2024-32793
Medium5.3Cross-Site Request Forgery
≤3.0.1Update to 3.0.2
CVE-2024-3215
Medium4.3Cross-Site Request Forgery
≤2.12.10Update to 3.0
CVE-2024-0588
Medium4.3Authenticated (Contributor+) Information Disclosure via Shortcode
≤2.12.8Update to 2.12.9
CVE-2024-1279
Medium4.3Authenticated (Contributor+) User Meta Disclosure
≤2.12.8Update to 2.12.9
—
Medium5.3Cross-Site Request Forgery to Level Orders Update
≤2.12.7Update to 2.12.8
CVE-2024-0624
Medium5.3Information Exposure in Debug Logs
≤2.12.6Update to 2.12.7
—
Medium5.3Missing Authorization via API
≤2.12.5Update to 2.12.6
CVE-2023-6855
High7.5Authenticated (Subscriber+) Arbitrary File Upload
≤2.12.3Update to 2.12.4
CVE-2023-6187
High7.7Authenticated (Subscriber+) SQL Injection via Shortcodes
≤2.9.11Update to 2.9.12
CVE-2023-0631
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤2.9.8Update to 2.9.9
CVE-2022-4830
Critical9.8Unauthenticated SQL Injection
≤2.9.7Update to 2.9.8
CVE-2023-23488
Critical9.8Unauthenticated SQL Injection
<2.6.7Update to 2.6.7
CVE-2021-25114
Medium6.1Reflected Cross-Site Scripting
<2.6.6Update to 2.6.6
CVE-2021-24979
Medium6.4Cross-Site Scripting
<2.5.10Update to 2.5.10
—
High8.8Authenticated SQL Injection
<2.5.6Update to 2.5.6
CVE-2021-20678
Medium4.3IDOR to Sensitive Information Disclosure
<2.5.3Update to 2.5.3
—
Medium6.4Cross-Site Scripting
≤2.5.0Update to 2.5.1
—
Medium4.3Cross-Site Request Forgery Bypass
<2.4.3Update to 2.4.3
CVE-2020-36754
Medium4.7Authenticated SQL Injection
<2.3.3Update to 2.3.3
CVE-2020-5579
High7.2Open Redirect
≤2.0.5Update to 2.0.6
—
Medium6.1Multiple Cross-Site Scripting
<1.8.4.3Update to 1.8.4.3
CVE-2015-5532
High7.5Directory Traversal
<1.7.15Update to 1.7.15
CVE-2014-8801

Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions: common questions

Does Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions have known vulnerabilities?

Yes. VulnCrest Radar lists 28 known vulnerabilities in Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions: 3 critical, 6 high, 19 medium. None are known to affect version null.

How do I check which version of Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions vulnerability?

CVE-2026-15016, published Jul 27, 2026: Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions <= 3.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).

Is any Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions vulnerability listed in CISA KEV?

No. None of the known Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?