CVE-2026-15016

Name of the Vulnerable Software and Affected Versions Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions versions prior to 3.8.2

Description Insufficient input sanitization and output escaping in the [pmpro member profile edit] shortcode allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via a readonly user field, enabling the injection of arbitrary web scripts that execute when a user visits the affected page.

Recommendations Update Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions to version 3.8.2 or later.