Vulnerabilities > Strangerstudios

DATE CVE VULNERABILITY TITLE RISK
2022-02-07 CVE-2021-25114 SQL Injection vulnerability in Strangerstudios Paid Memberships PRO
The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection
network
low complexity
strangerstudios CWE-89
7.5
2021-12-27 CVE-2021-24979 Cross-site Scripting vulnerability in Strangerstudios Paid Memberships PRO
The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
4.3
2021-03-18 CVE-2021-20678 SQL Injection vulnerability in Strangerstudios Paid Memberships PRO
SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
network
low complexity
strangerstudios CWE-89
8.8
2017-10-23 CVE-2015-5532 Cross-site Scripting vulnerability in Strangerstudios Paid Memberships PRO
Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to membershiplevels.php, (2) memberslist.php, or (3) orders.php in adminpages/ or the (4) edit parameter to adminpages/membershiplevels.php.
4.3
2014-11-28 CVE-2014-8801 Path Traversal vulnerability in Strangerstudios Paid Memberships PRO
Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attackers to read arbitrary files via a ..
network
low complexity
strangerstudios CWE-22
5.0