CVE-2026-119521: WordPress Paid Member Subscriptions plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

The vulnerability requires an authenticated attacker with low-level privileges and user interaction. It is remotely reachable, but the provided data does not identify which WordPress role or feature provides the required access.

Q: Which installations are affected?

Paid Member Subscriptions versions through 3.1.3 are affected. The provided data does not state whether a default plugin configuration is vulnerable or identify a fixed version.

Q: What is the likely impact if exploitation succeeds?

Successful exploitation allows stored cross-site scripting. The supplied CVSS vector indicates low confidentiality, integrity, and availability impact, with scope changed.

Published Nov 3, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Stored XSS.This issue affects Paid Member Subscriptions: from n/a through 3.1.3.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/paid-member-subscriptions to a version that resolves this vulnerability.
Fixed in 3.1.4

Event History

Nov 3, 2026

CVE Published

via MITRE·04:43 PM

Data Sourced

via MITRE·04:43 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vulnerability requires an authenticated attacker with low-level privileges and user interaction. It is remotely reachable, but the provided data does not identify which WordPress role or feature provides the required access.

Which installations are affected?

Paid Member Subscriptions versions through 3.1.3 are affected. The provided data does not state whether a default plugin configuration is vulnerable or identify a fixed version.

What is the likely impact if exploitation succeeds?

Successful exploitation allows stored cross-site scripting. The supplied CVSS vector indicates low confidentiality, integrity, and availability impact, with scope changed.

CVE-2026-119521: WordPress Paid Member Subscriptions plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which installations are affected?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which installations are affected?

What is the likely impact if exploitation succeeds?