Not rated
CVE-2023-0631 The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that…
Description
The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL query.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Paid Memberships Pro 1.5 | 1.5.5 → < 2.9.12 | 2.9.12 |
References
- wpscan.com wpscan.com
Timeline
- Published
- Last modified
Other CVEs of Paid Memberships Pro
The 5 CVEs of Paid Memberships Pro →
CVE-2024-1279
The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from…
4.3
Medium
CVE-2022-4830
The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes…
6.1
Medium
CVE-2021-25114
The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route…
Not rated
CVE-2021-24979
The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an…
Not rated