CVEs we hold for Paid
Records whose assigning authority named Paid as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-90922Paid Member Subscriptions < 3.0.9 - Unauthenticated Membership Payment Bypass via PayPal Standard Amount and Currency…Unknown Paid Membership Subscriptions
CVE-2026-14849Paid Member Subscriptions < 3.0.7 - Unauthenticated Sensitive Information Exposure via Residual Export FilesUnknown Paid Membership Subscriptions
CVE-2026-14848Paid Member Subscriptions < 3.0.8 - Subscriber+ Cross-User Subscription Hijack via process_checkoutUnknown Paid Membership Subscriptions
CVE-2026-14847Paid Member Subscriptions < 3.0.7 - Subscriber+ Payment Data Disclosure via IDORUnknown Paid Membership Subscriptions
CVE-2026-12497ProfilePress < 4.16.18 - Unauthenticated Privilege Escalation via Registration Role SelectionUnknown Paid Membership Plugin, Ecommerce, User…
CVE-2026-10820ProfilePress < 4.16.17 - Subscriber+ Subscription Cancellation via IDORUnknown Paid Membership Plugin, Ecommerce, User…
CVE-2024-37486WordPress Paid Memberships Pro plugin <= 3.0.5 - Authenticated SQL Injection vulnerabilityPaid Memberships Pro
CVE-2024-37277WordPress Paid Memberships Pro plugin <= 3.0.4 - Insecure Direct Object References (IDOR) vulnerabilityPaid Memberships Pro
CVE-2024-32794WordPress Paid Memberships Pro plugin <= 2.12.10 - Cross Site Request Forgery (CSRF) vulnerabilityPaid Memberships Pro
CVE-2024-32793WordPress Paid Memberships Pro plugin <= 2.12.10 - Cross Site Request Forgery (CSRF) vulnerabilityPaid Memberships Pro
CVE-2024-30523WordPress Paid Memberships Pro – Mailchimp Add On plugin <= 2.3.4 - Sensitive Data Exposure vulnerabilityPaid Memberships Pro – Mailchimp Add On
CVE-2024-30514WordPress Paid Memberships Pro – Payfast Gateway Add On plugin <= 1.4.1 - Sensitive Data Exposure via Log File…Paid Memberships Pro – Payfast Gateway Add On
CVE-2024-13121Paid Membership Plugin < 4.15.20 - Admin+ Stored XSSUnknown Paid Membership Plugin, Ecommerce, User…
CVE-2024-13120ProfilePress < 4.15.20 - Admin+ Stored XSSUnknown Paid Membership Plugin, Ecommerce, User…
CVE-2024-13119ProfilePress < 4.15.20 - Admin+ Stored XSSUnknown Paid Membership Plugin, Ecommerce, User…
CVE-2024-1279Paid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field DisclosureUnknown Paid Memberships Pro
CVE-2024-10518ProfilePress < 4.15.15 - Admin+ Stored XSSUnknown Paid Membership Plugin, Ecommerce, User…
CVE-2024-10517ProfilePress < 4.15.15 - Admin+ Stored XSSUnknown Paid Membership Plugin, Ecommerce, User…
CVE-2023-40608WordPress Paid Memberships Pro CCBill Gateway plugin <= 0.3 - Unauthenticated Broken Access Control vulnerabilityPaid Memberships Pro CCBill Gateway
CVE-2023-39990WordPress Paid Memberships Pro plugin <= 1.2.3 - Broken Access Control vulnerabilityPaid Memberships Pro
CVE-2022-4830Paid Memberships Pro < 2.9.9 - Contributor+ Stored XSS via ShortcodeUnknown Paid Memberships Pro
CVE-2021-25114Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL InjectionUnknown Paid Memberships Pro
CVE-2021-24979Paid Memberships Pro < 2.6.6 - Reflected Cross-Site ScriptingUnknown Paid Memberships Pro
25 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.