Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction

Software Type	Plugin
Software Slug	paid-member-subscriptions (view on wordpress.org)
Software Status	Active
Software Author	cozmoslabs
Software Website	www.cozmoslabs.com
Software Downloads	2,060,085
Software Active Installs	10,000
Software Record Last Updated	October 11, 2026

Showing 1-20 of 28 Vulnerabilities

Submit a Vulnerability

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.1 - Authenticated (Subscriber+) SQL Injection

6.5

CVE-2026-105317

Oct 5, 2026

Researcher: Deva Parekh

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.0.9 - Unauthenticated Unauthorized Subscription Activation

5.3

CVE-2026-97249

Sep 28, 2026

Researcher: MYUNGYONG LEE

Paid Member Subscriptions <= 3.0.0 - Unauthenticated CAPTCHA Bypass

5.3

CVE-2026-90950

Sep 21, 2026

Researcher: Naoki Kawahigashi

Paid Member Subscriptions <= 3.0.0 - Missing Authorization

5.3

CVE-2026-90951

Sep 21, 2026

Researcher: vuxvinh

Paid Member Subscriptions <= 3.0.8 - Unauthenticated Payment Bypass

5.3

CVE-2026-90922

Sep 15, 2026

Researcher: Charles Vosburgh

Paid Member Subscriptions <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Cross-User Subscription Hijack

4.3

CVE-2026-14848

Jul 27, 2026

Researcher: Revanth Hari Narayana Matte

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.0.7 - Insecure Direct Object Reference

4.3

CVE-2026-59539

Jul 23, 2026

Researcher: Ananda Dhakal

Paid Member Subscriptions <= 3.0.6 - Unauthenticated Information Exposure

5.3

CVE-2026-14849

Jul 13, 2026

Researchers: Giovanbattista Ianni, Alessandro Greco

Paid Member Subscriptions <= 3.0.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Payment Data Disclosure

4.3

CVE-2026-14847

Jul 13, 2026

Researcher: WEI HSIANG WANG

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.0.4 - Unauthenticated Server-Side Request Forgery

6.1

CVE-2026-57348

Jul 1, 2026

Researcher: yangsori

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.17.3 - Reflected Cross-Site Scripting

6.1

CVE-2026-39514

Apr 20, 2026

Researcher: loris4py

Paid Member Subscriptions <= 2.16.8 - Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVE-2025-68514

Feb 11, 2026

Researcher: daroo

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.16.4 - Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewal

5.3

CVE-2025-11835

Nov 4, 2025

Researcher: Rafshanzani Suhada

Paid Member Subscriptions <= 2.15.9 - Missing Authorization

5.3

CVE-2025-58600

Sep 3, 2025

Researcher: MD ISMAIL

Paid Membership Subscriptions <= 2.15.5 - Unauthenticated Local File Inclusion

8.1

CVE-2025-54017

Jul 29, 2025

Researcher: LVT-tholv2k

Paid Membership Subscriptions <= 2.15.5 - Unauthenticated Local File Inclusion

8.1

CVE-2025-54017

Jul 29, 2025

Researcher: LVT-tholv2k

Paid Member Subscriptions <= 2.15.1 - Unauthenticated SQL Injection

7.5

CVE-2025-49870

Jul 3, 2025

Researcher: ChuongVN

Paid Member Subscriptions <= 2.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2025-31088

Mar 28, 2025

Researcher: Muhammad Yudha - DJ

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.7 - Authentication Bypass via pms_payment_id

9.8

CVE-2024-12919

Jan 13, 2025

Researcher: wesley (wcraft)

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.4 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure

5.3

CVE-2024-11291

Dec 17, 2024

Researcher: Francesco Carlucci

Title	Status	CVE ID	CVSS	Researchers	Date
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.1 - Authenticated (Subscriber+) SQL Injection	Patched	CVE-2026-105317	6.5	Deva Parekh	October 5, 2026
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.0.9 - Unauthenticated Unauthorized Subscription Activation	Patched	CVE-2026-97249	5.3	MYUNGYONG LEE	September 28, 2026
Paid Member Subscriptions <= 3.0.0 - Unauthenticated CAPTCHA Bypass	Patched	CVE-2026-90950	5.3	Naoki Kawahigashi	September 21, 2026
Paid Member Subscriptions <= 3.0.0 - Missing Authorization	Patched	CVE-2026-90951	5.3	vuxvinh	September 21, 2026
Paid Member Subscriptions <= 3.0.8 - Unauthenticated Payment Bypass	Patched	CVE-2026-90922	5.3	Charles Vosburgh	September 15, 2026
Paid Member Subscriptions <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Cross-User Subscription Hijack	Patched	CVE-2026-14848	4.3	Revanth Hari Narayana Matte	July 27, 2026
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.0.7 - Insecure Direct Object Reference	Patched	CVE-2026-59539	4.3	Ananda Dhakal	July 23, 2026
Paid Member Subscriptions <= 3.0.6 - Unauthenticated Information Exposure	Patched	CVE-2026-14849	5.3	Giovanbattista Ianni, Alessandro Greco	July 13, 2026
Paid Member Subscriptions <= 3.0.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Payment Data Disclosure	Patched	CVE-2026-14847	4.3	WEI HSIANG WANG	July 13, 2026
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.0.4 - Unauthenticated Server-Side Request Forgery	Patched	CVE-2026-57348	6.1	yangsori	July 1, 2026
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.17.3 - Reflected Cross-Site Scripting	Patched	CVE-2026-39514	6.1	loris4py	April 20, 2026
Paid Member Subscriptions <= 2.16.8 - Authenticated (Subscriber+) Insecure Direct Object Reference	Patched	CVE-2025-68514	4.3	daroo	February 11, 2026
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.16.4 - Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewal	Patched	CVE-2025-11835	5.3	Rafshanzani Suhada	November 4, 2025
Paid Member Subscriptions <= 2.15.9 - Missing Authorization	Patched	CVE-2025-58600	5.3	MD ISMAIL	September 3, 2025
Paid Membership Subscriptions <= 2.15.5 - Unauthenticated Local File Inclusion	Patched	CVE-2025-54017	8.1	LVT-tholv2k	July 29, 2025
Paid Membership Subscriptions <= 2.15.5 - Unauthenticated Local File Inclusion	Patched	CVE-2025-54017	8.1	LVT-tholv2k	July 29, 2025
Paid Member Subscriptions <= 2.15.1 - Unauthenticated SQL Injection	Patched	CVE-2025-49870	7.5	ChuongVN	July 3, 2025
Paid Member Subscriptions <= 2.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting	Patched	CVE-2025-31088	6.4	Muhammad Yudha - DJ	March 28, 2025
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.7 - Authentication Bypass via pms_payment_id	Patched	CVE-2024-12919	9.8	wesley (wcraft)	January 13, 2025
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.4 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure	Patched	CVE-2024-11291	5.3	Francesco Carlucci	December 17, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation