Paid Member Subscriptions CVE-2026-119521

Exploitation requires an authenticated account with at least low-level privileges (PR:L) capable of submitting input that the Paid Member Subscriptions plugin stores and later renders - the available sources do not name the exact field, form, or admin/front-end page carrying the injectable input, so the precise trigger is not described in the available sources. Realization of the attack additionally requires a second user (victim or administrator) to view the page containing the stored payload (UI:R), which limits reliability and timing. These factors - required authentication, required victim interaction, and dependence on the attacker having an account on the target WordPress site - meaningfully constrain exploitation despite the network attack vector. Affected scope is Paid Member Subscriptions versions up to and including 3.1.3.

This is a moderate-severity stored Cross-Site Scripting flaw (CVSS 6.5) in the Cozmoslabs Paid Member Subscriptions WordPress plugin. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) indicates network-reachable, low-complexity exploitation that requires some authenticated privilege (PR:L) and a victim's interaction (UI:R) to trigger the stored payload; the scope change (S:C) reflects that injected script executes in another user's browser/security context. No EPSS score is provided, so statistical exploitation likelihood cannot be quantified. It is NOT on the CISA KEV list and there is no public exploit identified at time of analysis - only a Patchstack database reference, which is a PoC reference that is not verified as working exploit code. The vuln.today decision label is 'this_month', consistent with a real but non-emergency priority: a plugin flaw worth remediating in the normal patch cycle rather than an active-exploitation fire drill. The practical risk is bounded by the need for pre-existing authenticated access to store the payload and for a victim to view the affected page, so this is a genuine but moderate priority rather than a high-urgency issue.

An authenticated low-privilege user (as required by PR:L) submits a crafted input containing a malicious script into a field rendered by the Paid Member Subscriptions plugin, where it is stored without proper neutralization. When another user or an administrator later views the page containing that stored input (satisfying UI:R), the script executes in their browser session. A public PoC reference exists via Patchstack; it is not verified as working exploit code.