Medium
CVE-2026-15016
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 28
Reset filters
High
CVE-2026-4100
Paid Memberships Pro <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption
Critical
CVE-2024-37486
Paid Memberships Pro <= 3.0.5 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2024-37277
Paid Memberships Pro <= 3.0.4 - Unauthenticated Insecure Direct Object Reference to Order Status Update
Medium
CVE-2024-1407
Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery to Membership Modification
Medium
CVE-2024-32793
Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery
Medium
CVE-2024-3215
Paid Memberships Pro <= 3.0.1 - Cross-Site Request Forgery
Medium
CVE-2024-0588
Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery
Medium
CVE-2024-1279
Paid Memberships Pro <= 2.12.8 - Authenticated (Contributor+) Information Disclosure via Shortcode
Medium
f6c5e3f8-ebbd-4cc3-b9b1-3f1704e3c07a
Paid Memberships Pro <= 2.12.8 - Authenticated (Contributor+) User Meta Disclosure
Medium
CVE-2024-0624
Paid Memberships Pro <= 2.12.7 - Cross-Site Request Forgery to Level Orders Update
Medium
852b1895-3bed-4c2f-912c-c136b38a09bb
Paid Memberships Pro <= 2.12.6 - Information Exposure in Debug Logs
Medium
CVE-2023-6855
Paid Memberships Pro <= 2.12.5 - Missing Authorization via API
High
CVE-2023-6187
Paid Memberships Pro <= 2.12.3 - Authenticated (Subscriber+) Arbitrary File Upload
High
CVE-2023-0631
Paid Memberships Pro <= 2.9.11 - Authenticated (Subscriber+) SQL Injection via Shortcodes
Medium
CVE-2022-4830
Paid Memberships Pro <= 2.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Critical
CVE-2023-23488
Paid Memberships Pro < 2.9.8 - Unauthenticated SQL Injection
Critical
CVE-2021-25114
Paid Memberships Pro <= 2.6.6 - Unauthenticated SQL Injection
Medium
CVE-2021-24979
Paid Memberships Pro <= 2.6.5 - Reflected Cross-Site Scripting
Medium
2621cb32-3753-42e7-8690-88c680bdf808
Paid Memberships Pro – Restrict Member Access to Content, Courses, Communities – Free or Paid Subscriptions <= 2.5.9.1 - Cross-Site Scripting
High
CVE-2021-20678
Paid Memberships Pro <= 2.5.5 - Authenticated SQL Injection
Medium
0eb90948-b2b6-4e30-b903-95b7bce5d734
Paid Memberships Pro – Restrict Member Access to Content, Courses, Communities – Free or Paid Subscriptions <= 2.5.2 - IDOR to Sensitive Information Disclosure
Medium
8a68d036-9109-4bc0-9451-47fa2f9fa628
Paid Memberships Pro <= 2.5.0 - Cross-Site Scripting
Medium
CVE-2020-36754
Paid Memberships Pro <= 2.4.2 - Cross-Site Request Forgery Bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.