EUVD-2026-49789
GHSA-29wc-fx5p-m6r7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS via subscriber-level authenticated user, scope changed due to browser script execution in other users' sessions.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Paid Memberships Pro - Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Readonly User Field via [pmpro_member_profile_edit] Shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting in the Paid Memberships Pro WordPress plugin allows authenticated attackers with subscriber-level access to inject arbitrary web scripts via the readonly user field rendered by the [pmpro_member_profile_edit] shortcode. The vulnerability affects all plugin versions up to and including 3.8.1. Upon successful exploitation, injected scripts execute when any user accesses a page containing the malicious payload, potentially leading to session hijacking or other browser-based attacks.
Technical ContextAI
The flaw resides in the handling of the [pmpro_member_profile_edit] shortcode, which displays user profile fields in a readonly format. Insufficient input sanitization and output escaping (CWE-79) allow an attacker to store malicious JavaScript in user-controlled data. The vulnerability is specific to the WordPress plugin ecosystem; the affected component is the Paid Memberships Pro plugin (CPE: cpe:2.3:a:strangerstudios:paid_memberships_pro:*:*:*:*:*:wordpress:*:* up to 3.8.1). Output encoding failures in the shortcode renderer enable persistent script injection that executes in the context of any viewer's session.
RemediationAI
Immediately update the Paid Memberships Pro plugin to the latest available version (the patch is presumed to be in a release after 3.8.1); check the vendor release notes for the exact fixed version. If immediate patching is not possible, remove or disable the [pmpro_member_profile_edit] shortcode from all site content; this blocks the attack vector but removes user-facing profile pages. Alternatively, restrict subscriber registration to trusted users and audit existing user profile data for injected payloads, though this does not prevent exploitation by existing attackers. No other practical workarounds are documented.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today