These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. Authenticated attackers with Subscriber-level access and above can inject arbitrary shortcodes by posting a comment whose body contains the shortcode markup. The shortcode is then executed se [truncated]
The MailOptin plugin for WordPress is vulnerable to unauthenticated privilege escalation due to the `subscribe_to_email_list` endpoint accepting an attacker-supplied `optin_data[form_custom_field_mappings]` parameter without validation, allowing attackers to override administrator-saved mappings and pass arbitrary `wp_users` column names to `wp_insert_user()`. This could lead to full site compromise by al [truncated]
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ppress_billing_address Filename Parameter in all versions up to, and including, 4.17.4. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can suc [truncated]
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure. Authenticated attackers with subscriber-level access and above can extract other users' email addresses, login names, and registration dates via the Member Directory's per-row user rebinding when attacker-controlled [truncated]
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.17.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticate [truncated]
CVE-2026-66703 is a Medium-severity Contributor Cross Site Scripting (XSS) vulnerability in MailOptin plugin versions <= 1.2.78.0. The vulnerability has a CVSS score of 6.5. Affected users should review and apply vendor patches or upgrades to mitigate this vulnerability. The CVE record was published on 2026-08-06T15:17:23.273Z and has not been modified since then. Users of MailOptin plugin versions <= 1.2 [truncated]
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress has an Arbitrary File Upload vulnerability in all versions up to, and including, 4.16.18. This is due to an unconditional registration of an upload_mimes filter that adds executable file extensions to the global WordPress MIME allowlist without scoping it to digita [truncated]
CVE-2026-57813 is a Privilege Escalation vulnerability in MailOptin, a WordPress plugin, due to incorrect privilege assignment. This issue affects MailOptin versions from n/a through 1.2.77.3. The vulnerability has a CVSS score of 9.8 and is considered CRITICAL. Defenders should verify exposure, apply remediation, and monitor logs. The CVE Program and NVD provide official information about the vulnerabili [truncated]
A Subscriber Cross Site Scripting (XSS) vulnerability was discovered in ProfilePress plugin versions up to 4.16.13. The vulnerability has been assigned a CVSS score of 6.5, indicating a medium severity level.
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.11. This is due to the plugin allowing user-supplied billing field values from the checkout process to be interpolated into shortcode template strings that are subsequently pr [truncated]
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to unauthorized membership payment bypass in all versions up to, and including, 4.16.11. This vulnerability allows authenticated attackers, with subscriber level access and above, to reference another user's active subscription during checkout to mani [truncated]
