CVE-2026-39514
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Versions of Paid Member Subscriptions up to 2.17.3 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
Risk Assessment
This vulnerability may lead to user data theft and session hijacking, posing a serious threat to the organization's security.
Recommendation
It is recommended to update the Paid Member Subscriptions plugin to the latest version to mitigate this vulnerability.
Other vulnerabilities in Paid Member Subscriptions
See all- CVE-2026-59539High
The Paid Member Subscriptions plugin in version 3.0.7 and earlier allows users with the Subscriber role to exploit Insecure Direct Object References (IDOR). This enables access to other users' resources without authorization.
- CVE-2026-57348High
The Paid Member Subscriptions plugin version 3.0.4 and earlier contains an unauthenticated Server Side Request Forgery (SSRF) vulnerability. An attacker can send crafted HTTP requests that are executed by the server, enabling access to internal network resources.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions.