Skip to content
fr Sign in
6.1 Medium

CVE-2022-4830 The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes…

Description

The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Affected products and versions

Product Affected versions Fixed in
Paid Memberships Pro 2.9 earliest → < 2.9.9 2.9.9

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Paid Memberships Pro

The 5 CVEs of Paid Memberships Pro →
CVE-2024-1279 The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from… 4.3 Medium CVE-2023-0631 The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that… Not rated CVE-2021-25114 The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route… Not rated CVE-2021-24979 The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an… Not rated
Track this CVE