Paid Memberships Pro (Unknown) - vulnerabilities (CVEs)

5 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2024-03-11. Vendor: Unknown.

CVEs of Paid Memberships Pro

• CVE-2024-1279 - CVSS 4.3 (medium), 2024-03-11: The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users' sensitive metadata.
• CVE-2023-0631 - CVSS 8.8 (high), 2023-03-20: The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an…
• CVE-2022-4830 - CVSS 6.1 (medium), 2023-02-13: The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page,…
• CVE-2021-25114 - CVSS 9.8 (critical), 2022-02-07: The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before…
• CVE-2021-24979 - CVSS 6.1 (medium), 2021-12-27: The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to…