Unknown Paid Membership Subscriptions vulnerabilities

6 CVEs affecting Unknown Paid Membership Subscriptions, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-90950, published 2026-09-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-90922, published 2026-09-17. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing…
CVE-2026-14848, published 2026-08-04. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user, allowing…
CVE-2026-14849, published 2026-07-31. Low severity, CVSS 3.7. EPSS: 0.3% chance of exploitation in the next 30 days. The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing…
CVE-2026-14847, published 2026-07-31. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowing any authenticated user with…
CVE-2026-90950, published 2026-09-23. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users…
CVE-2026-90951, published 2026-09-23. Low severity, CVSS 3.7. EPSS: 0.2% chance of exploitation in the next 30 days. The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight…