Stranger Studios Paid Memberships Pro

The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpro/v1/order' REST route.

Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL Injection

WordPress Paid Memberships Pro plugin <= 3.0.4 - Insecure Direct Object References (IDOR) vulnerability

Paid Memberships Pro < 2.9.12 - Subscriber+ SQL Injection

Paid Memberships Pro <= 2.12.3 - Authenticated (Subscriber+) Arbitrary File Upload

SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.

WordPress Paid Memberships Pro plugin <= 1.2.3 - Broken Access Control vulnerability

WordPress Paid Memberships Pro plugin <= 2.12.10 - Cross Site Request Forgery (CSRF) vulnerability

WordPress Paid Memberships Pro plugin <= 2.12.10 - Cross Site Request Forgery (CSRF) vulnerability

WordPress Paid Memberships Pro plugin <= 3.0.5 - Authenticated SQL Injection vulnerability

SQL injection vulnerability in the Paid Memberships versions prior to 2.3.3 allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors.

Paid Memberships Pro - Member Directory Add On < 1.2.6 - Contributor+ Sensitive Information Disclosure via SQLi

Paid Memberships Pro < 2.9.9 - Contributor+ Stored XSS via Shortcode

Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to membershiplevels.php, (2) memberslist.php, or (3) orders.php in adminpages/ or the (4) edit parameter to adminpages/membershiplevels.php.

Paid Memberships Pro < 2.6.6 - Reflected Cross-Site Scripting

Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery to Membership Modification

Paid Memberships Pro <= 2.12.7 - Cross-Site Request Forgery to Level Orders Update

Paid Memberships Pro <= 2.12.5 - Missing Authorization via API

Paid Memberships Pro <= 3.0.1 - Cross-Site Request Forgery

Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the QUERY_STRING in a getfile action to wp-admin/admin-ajax.php.

Paid Memberships Pro - Membership Maps Add On < 0.7 - Contributor+ Sensitive Information Disclosure

Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery

Paid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field Disclosure

Paid Memberships Pro <= 2.4.2 - Cross-Site Request Forgery Bypass