CVE-2015-5532

Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to membershiplevels.php, (2) memberslist.php, or (3) orders.php in adminpages/ or the (4) edit parameter to adminpages/membershiplevels.php.

• CWE-79

• http://packetstormsecurity.com/files/132812/WordPress-Paid-Memberships-Pro-1.8.4.2-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://www.paidmembershipspro.com/2015/07/pmpro-updates-1-8-4-3-and-1-8-4-4/Release Notes, Third Party Advisory
• http://www.securityfocus.com/archive/1/536057/100/0/threadedExploit, Third Party Advisory, VDB Entry
• https://github.com/strangerstudios/paid-memberships-pro/commit/add03e3ed90e9163e5a46e20e6c371a87ff5a677Patch, Third Party Advisory
• https://wordpress.org/plugins/paid-memberships-pro/#developersRelease Notes, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/8109Third Party Advisory
• https://www.htbridge.com/advisory/HTB23264Broken Link
• http://packetstormsecurity.com/files/132812/WordPress-Paid-Memberships-Pro-1.8.4.2-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://www.paidmembershipspro.com/2015/07/pmpro-updates-1-8-4-3-and-1-8-4-4/Release Notes, Third Party Advisory
• http://www.securityfocus.com/archive/1/536057/100/0/threadedExploit, Third Party Advisory, VDB Entry
• https://github.com/strangerstudios/paid-memberships-pro/commit/add03e3ed90e9163e5a46e20e6c371a87ff5a677Patch, Third Party Advisory
• https://wordpress.org/plugins/paid-memberships-pro/#developersRelease Notes, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/8109Third Party Advisory
• https://www.htbridge.com/advisory/HTB23264Broken Link

Published

Oct 23, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-5523The ParseValue function in lexer.c in tidy before 4.9.31 all…
• CVE-2015-5524An issue was discovered on Samsung mobile devices with KK(4.…9.8
• CVE-2015-5528Cross-site scripting (XSS) vulnerability in the save_order f…
• CVE-2015-5529Multiple cross-site scripting (XSS) vulnerabilities in Free …
• CVE-2015-5530Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2015-5531Directory traversal vulnerability in Elasticsearch before 1.…
• CVE-2015-5533SQL injection vulnerability in counter-options.php in the Co…
• CVE-2015-5534Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2015-5535Cross-site scripting (XSS) vulnerability in the qTranslate p…
• CVE-2015-5536Belkin N300 Dual-Band Wi-Fi Range Extender with firmware bef…
• CVE-2015-5537The SSL layer of the HTTPS service in Siemens RuggedCom ROS …
• CVE-2015-5538Multiple unspecified vulnerabilities in Citrix NetScaler App…