Vulnerabilities

TI-2024-24792 CVE-2024-37277 · GHSA-29g9-48v7-9r7c

WordPress Paid Memberships Pro plugin <= 3.0.4 - Insecure Direct Object References (IDOR) vulnerability

MEDIUM 49

Authorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Paid Memberships Pro: from n/a through 3.0.4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0067 Published 2024-11-01 No fix listed CWE-639

TI-2024-24990 CVE-2024-37486 · GHSA-j3c9-j8gj-cwrv

WordPress Paid Memberships Pro plugin <= 3.0.5 - Authenticated SQL Injection vulnerability

LOW 35

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 3.0.5.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00745 Published 2024-07-09 No fix listed CWE-89

TI-2023-20882 CVE-2023-39990 · GHSA-r9pc-m5v5-x22j

WordPress Paid Memberships Pro plugin <= 1.2.3 - Broken Access Control vulnerability

LOW 39

Missing Authorization vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 1.2.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00479 Published 2024-06-19 No fix listed CWE-862

TI-2023-21406 CVE-2023-40608 · GHSA-m4wx-v2r3-84vx

WordPress Paid Memberships Pro CCBill Gateway plugin <= 0.3 - Unauthenticated Broken Access Control vulnerability

MEDIUM 42

Missing Authorization vulnerability in Paid Memberships Pro Paid Memberships Pro CCBill Gateway.This issue affects Paid Memberships Pro CCBill Gateway: from n/a through 0.3.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00443 Published 2024-06-19 No fix listed CWE-862

TI-2024-21667 CVE-2024-32793 · GHSA-9q4q-2xpr-pvwv

WordPress Paid Memberships Pro plugin <= 2.12.10 - Cross Site Request Forgery (CSRF) vulnerability

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 2.12.10.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00233 Published 2024-04-24 No fix listed CWE-352

TI-2024-21668 CVE-2024-32794 · GHSA-4386-m5jw-9jgw

WordPress Paid Memberships Pro plugin <= 2.12.10 - Cross Site Request Forgery (CSRF) vulnerability

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 2.12.10.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00245 Published 2024-04-24 No fix listed CWE-352

TI-2024-20247 CVE-2024-30523 · GHSA-vx87-p8vv-j974

WordPress Paid Memberships Pro – Mailchimp Add On plugin <= 2.3.4 - Sensitive Data Exposure vulnerability

LOW 24

Insertion of Sensitive Information into Log File vulnerability in Paid Memberships Pro Paid Memberships Pro – Mailchimp Add On pmpro-mailchimp.This issue affects Paid Memberships Pro – Mailchimp Add On: from n/a through…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00444 Published 2024-03-31 No fix listed CWE-532

TI-2024-20238 CVE-2024-30514 · GHSA-q5gv-8p63-3qrr

Sensitive information in log files in Paid Memberships Pro – Payfast Gateway Add On

LOW 30

Insertion of Sensitive Information into Log File vulnerability in Paid Memberships Pro Paid Memberships Pro – Payfast Gateway Add On.This issue affects Paid Memberships Pro – Payfast Gateway Add On: from n/a through 1.4.…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0047 Published 2024-03-29 No fix listed CWE-532

TI-2022-04427 CVE-2022-4831 · GHSA-h3h9-3wxx-wwcf

Custom User Profile Fields for User Registration & Member Frontend Profiles with Paid…

MEDIUM 58

The Custom User Profile Fields for User Registration WordPress plugin before 1.8.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a rol…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00548 Published 2023-01-30 Fixed in 1.8.1

Vulnerabilities

Filters