Executive brief
The Paid Memberships Pro plugin for WordPress, which manages user registrations and subscriptions, contains a security flaw in its profile editing feature. This vulnerability allows logged-in users with basic account access to inject malicious scripts into the website. These scripts can then execute in the browsers of other users, potentially leading to unauthorized actions or data theft.
Technical details
The Paid Memberships Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'Readonly User Field' within the [pmpro_member_profile_edit] shortcode. The root cause is insufficient input sanitization and output escaping of user-supplied data. An authenticated attacker with at least subscriber-level privileges can inject malicious JavaScript into their profile fields. This script is then stored on the server and executed in the context of any user (including administrators) who views the compromised profile page. The vulnerability affects all versions up to and including 3.8.1.
Affected products
- Stranger Studios Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions <= 3.8.1
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory