PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39514 Cozmoslabs CVE debrief

CVE-2026-39514 is a HIGH severity Unauthenticated Cross Site Scripting (XSS) vulnerability affecting Paid Member Subscriptions plugin versions <= 2.17.3. The vulnerability has a CVSS score of 7.1 and was published on [cvePublishedAt](https://www.cve.org/CVERecord?id=CVE-2026-39514). The vulnerability was reported by Patchstack.

Vendor
Cozmoslabs
Product
Paid Member Subscriptions
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-15
Original CVE updated
2026-06-15
Advisory published
2026-06-15
Advisory updated
2026-06-15

Who should care

Users of Paid Member Subscriptions plugin versions <= 2.17.3 should update to a patched version to prevent exploitation of this vulnerability.

Technical summary

The vulnerability is a reflected Cross-Site Scripting (XSS) vulnerability in the Paid Member Subscriptions plugin. The vulnerability has been assigned a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L.

Defensive priority

HIGH

Recommended defensive actions

  • Update Paid Member Subscriptions plugin to a version greater than 2.17.3.
  • Review and apply patches provided by the vendor.

Evidence notes

Evidence for this CVE was provided by Patchstack (see [ref-4](https://patchstack.com/database/wordpress/plugin/paid-member-subscriptions/vulnerability/wordpress-paid-member-subscriptions-plugin-2-17-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve)).

Official resources

CVE-2026-39514 was published on 2026-06-15T21:16:46.090Z and modified on 2026-06-15T21:24:32.790Z.