CVE-2026-119521
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The WordPress plugin Paid Member Subscriptions up to version 3.1.3 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious JavaScript can be persistently stored and executed in a user's browser.
Risk Assessment
An attacker can execute arbitrary script in the victim's browser context, hijack sessions, or perform actions on behalf of an administrator. This may lead to account takeover or site content modification.
Recommendation
Update Paid Member Subscriptions to a version later than 3.1.3. Until then, consider disabling the plugin or restricting user content input capabilities.
Other vulnerabilities in Paid Member Subscriptions
See all- CVE-2026-97249Medium
Unauthenticated Bypass Vulnerability in Paid Member Subscriptions versions up to 3.0.9.
- CVE-2026-112842Medium
The Paid Member Subscriptions plugin for WordPress (through 3.1.2) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This may enable unauthorized access to subscription-protected features or data.
- CVE-2026-105317High
SQL Injection vulnerability in Paid Member Subscriptions up to version 3.1.1 allows a subscriber to inject malicious SQL code into database queries.
- CVE-2026-59539High
The Paid Member Subscriptions plugin in version 3.0.7 and earlier allows users with the Subscriber role to exploit Insecure Direct Object References (IDOR). This enables access to other users' resources without authorization.
- CVE-2026-57348High
The Paid Member Subscriptions plugin version 3.0.4 and earlier contains an unauthenticated Server Side Request Forgery (SSRF) vulnerability. An attacker can send crafted HTTP requests that are executed by the server, enabling access to internal network resources.
- CVE-2026-39514High
Versions of Paid Member Subscriptions up to 2.17.3 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Stored XSS.This issue affects Paid Member Subscriptions: from n/a through 3.1.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS