Not rated
CVE-2021-24979 The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an…
Description
The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Paid Memberships Pro 2.6 | earliest → < 2.6.6 | 2.6.6 |
References
- wpscan.com wpscan.com
- plugins.trac.wordpress.org plugins.trac.wordpress.org
Timeline
- Published
- Last modified
Other CVEs of Paid Memberships Pro
The 5 CVEs of Paid Memberships Pro →
CVE-2024-1279
The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from…
4.3
Medium
CVE-2023-0631
The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that…
Not rated
CVE-2022-4830
The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes…
6.1
Medium
CVE-2021-25114
The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route…
Not rated