WordPress paid-memberships-pro has 17 known advisories in the phpwarden feed. Feed 2026.10.29.4, updated 2026-10-29.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2023-23488 | The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' para | critical | 9.8 | <2.9.8 | 2.9.8 |
| CVE-2021-25114 | The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthentica | critical | 9.8 | >=2.4 and <2.4.5 or >=2.5 and <2.5.11 or >=2.6 and <2.6.7 | 2.4.5, 2.5.11, 2.6.7 |
| CVE-2022-4830 | The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes before outputting them | medium | 5.4 | <2.9.9 | 2.9.9 |
| CVE-2023-0631 | The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes d | high | 8.8 | <2.9.12 | 2.9.12 |
| CVE-2023-6187 | The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'pmpro | high | 7.5 | <=2.12.3 | – |
| CVE-2014-8801 | Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attac | medium | 5.0 | <1.7.15 | 1.7.15 |
| CVE-2015-5532 | Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress allow remote att | medium | 6.1 | <1.8.4.3 | 1.8.4.3 |
| CVE-2021-24979 | The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin | medium | 6.1 | <2.6.6 | 2.6.6 |
| CVE-2024-0624 | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Req | medium | 5.3 | <=2.12.7 | – |
| CVE-2024-0588 | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Req | medium | 4.3 | <3.0 | 3.0 |
| CVE-2024-1286 | The pmpro-membership-maps WordPress plugin before 0.7 does not prevent users with at least the contributor role from leaking sensitive infor | medium | 4.9 | <0.7 | 0.7 |
| CVE-2024-1279 | The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users' s | medium | 4.3 | <2.12.9 | 2.12.9 |
| CVE-2024-1287 | The pmpro-member-directory WordPress plugin before 1.2.6 does not prevent users with at least the contributor role from leaking other users' | medium | 6.5 | <1.2.6 | 1.2.6 |
| CVE-2023-6855 | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to unauthorized m | medium | 5.3 | <=2.12.5 | – |
| CVE-2020-36754 | The Paid Memberships Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.2. This is | medium | 4.3 | <=2.4.2 | – |
| CVE-2024-3215 | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Req | medium | 5.3 | <3.0.2 | 3.0.2 |
| CVE-2024-1407 | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Req | medium | 5.4 | <3.0 | 3.0 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden wordpress /var/www/html # or, without Composer pipx install phpwarden && phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked