High · 7.1 CVE-2026-39514 EUVD-2026-36953GHSA-pph5-c47c-2wv3

WordPress Paid Member Subscriptions plugin <= 2.17.3 - Reflected Cross Site Scripting (XSS) vulnerability

Published Jun 15, 2026 · Updated Jun 15, 2026 · Assigned by Patchstack

Vendor: Cozmoslabs Product: Paid Member Subscriptions

Description

Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions.

Affected products

Vendor	Product	Affected	Fixed
Cozmoslabs	Paid Member Subscriptions	≤ 2.17.3	—

References

https://patchstack.com/database/wordpress/plugin/paid-member-subscriptions/vulnerability/wordpress-paid-member-subscriptions-plugin-2-17-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry