Skip to content
Noroxi

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction

paid-member-subscriptions · plugin

Known security vulnerabilities for Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction. Find out in seconds which version runs on your site with WP Lens.

19 known vulnerabilities

1 critical · 14 exploitable without logging in · latest Sep 30, 2026

Listed on wordpress.org · latest 3.1.1 · last updated Sep 29, 2026 · 10K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2024-12919unauthenticated≤ 2.13.7

    Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.7 - Authentication Bypass via pms_payment_id

    Critical 9.8

  • CVE-2023-51522unauthenticated · needs a click≤ 2.10.4

    WordPress Paid Membership Subscriptions plugin <= 2.10.4 - Cross Site Request Forgery (CSRF) vulnerability

    High 8.8

  • CVE-2021-24728login required→ 2.4.2

    Paid Member Subscriptions < 2.4.2 - Authenticated SQL Injection

    High 8.8

  • CVE-2025-54017unauthenticated · needs a click≤ 2.15.4

    WordPress Paid Member Subscriptions <= 2.15.4 - Local File Inclusion Vulnerability

    High 7.5

  • CVE-2025-49870unauthenticated≤ 2.15.1

    WordPress Paid Member Subscriptions plugin <= 2.15.1 - SQL Injection Vulnerability

    High 7.5

  • CVE-2026-59539subscriber+≤ 3.0.7

    WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability

    High 7.5

  • CVE-2024-10261unauthenticated≤ 2.13.0

    Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.0 - Unauthenticated Arbitrary Shortcode Execution

    High 7.3

  • CVE-2026-57348unauthenticated≤ 3.0.4

    WordPress Paid Member Subscriptions plugin <= 3.0.4 - Server Side Request Forgery (SSRF) vulnerability

    High 7.2

  • CVE-2026-39514unauthenticated · needs a click≤ 2.17.3

    WordPress Paid Member Subscriptions plugin <= 2.17.3 - Reflected Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2025-68514login required≤ 2.16.8

    WordPress Paid Member Subscriptions plugin <= 2.16.8 - Insecure Direct Object References (IDOR) vulnerability

    Medium 6.5

  • CVE-2025-31088login required≤ 2.14.3

    WordPress Paid Member Subscriptions plugin <= 2.14.3 - Cross Site Scripting (XSS) Vulnerability

    Medium 6.5

  • CVE-2024-9222unauthenticated · needs a click≤ 2.12.8

    Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.12.8 - Reflected Cross-Site Scripting

    Medium 6.1

  • CVE-2026-97249unauthenticated≤ 3.0.9

    WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vulnerability

    Medium 5.3

  • CVE-2025-11835unauthenticated≤ 2.16.4

    Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.16.4 - Missing Authorization to Unauthenticated Arbitrary

    Medium 5.3

  • CVE-2025-58600unauthenticated≤ 2.15.9

    WordPress Paid Member Subscriptions Plugin <= 2.15.9 - Broken Access Control Vulnerability

    Medium 5.3

  • CVE-2024-11291unauthenticated≤ 2.13.4

    Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.4 - Unauthenticated Content Restriction Bypass to Sensi

    Medium 5.3

  • CVE-2024-1389unauthenticated≤ 2.11.1

    Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via pms_stripe_connect_handle

    Medium 5.3

  • CVE-2024-32728unauthenticated · needs a click≤ 2.11.0

    WordPress Paid Membership Subscriptions plugin <= 2.11.0 - Cross Site Request Forgery (CSRF) vulnerability

    Medium 4.3

  • CVE-2024-1390subscriber+≤ 2.11.1

    Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via creating_pricing_table_pa

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory