CVE-2026-15016: Paid Memberships Pro WordPress XSS Flaw

CVE-2026-15016 Overview

CVE-2026-15016 is a stored Cross-Site Scripting (XSS) vulnerability in the Paid Memberships Pro WordPress plugin. The flaw affects all versions up to and including 3.8.1. It resides in the handling of readonly user fields exposed through the [pmpro_member_profile_edit] shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access or higher to inject arbitrary web scripts. Injected payloads execute in the browsers of users who visit affected pages. The issue is categorized under CWE-79.

Critical Impact
Authenticated subscribers can persist JavaScript payloads that execute against site visitors and administrators, enabling session theft, account takeover pivots, and content defacement.

Affected Products

Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress
All plugin versions up to and including 3.8.1
WordPress sites exposing the [pmpro_member_profile_edit] shortcode

Discovery Timeline

2026-07-28 - CVE-2026-15016 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-15016

Vulnerability Analysis

The vulnerability affects the profile editing workflow rendered by the [pmpro_member_profile_edit] shortcode. The plugin exposes user-controlled fields, including readonly fields, without applying sufficient sanitization on input or escaping on output. An authenticated user with subscriber privileges can submit crafted values that reach the rendered profile page unescaped. The stored payload triggers whenever another user, including higher-privileged accounts, loads a page containing the injected content. The scope is marked as changed in the CVSS vector, reflecting that script execution crosses the security boundary between the low-privilege attacker and other site users.

Root Cause

The plugin fails to apply WordPress escaping primitives such as esc_attr() or esc_html() on user-supplied values rendered through the readonly field logic in the profile edit shortcode. Server-side validation does not strip or neutralize HTML and JavaScript syntax before persistence. Because readonly attributes are enforced only in the browser, attackers bypass them by submitting values through direct HTTP requests.

Attack Vector

An attacker registers or authenticates as a subscriber-level user. The attacker submits a crafted payload targeting the vulnerable field handled by the [pmpro_member_profile_edit] shortcode. The payload persists in the database. When any user, including administrators, views a page that renders the affected profile field, the browser executes the injected script in the site's origin context. This enables session hijacking, forced administrative actions, and phishing overlays.

See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-15016

Indicators of Compromise

Profile fields or user meta entries containing <script>, onerror=, onload=, or javascript: substrings.
Unexpected outbound requests from browser sessions of administrators or editors after viewing member profile pages.
New or modified WordPress administrator accounts created shortly after subscriber-level logins.
HTTP POST requests to profile update endpoints with payloads containing HTML tags in readonly field parameters.

Detection Strategies

Query the wp_usermeta table for values containing HTML tags or script fragments in Paid Memberships Pro-managed fields.
Inspect web server access logs for subscriber accounts submitting unusually large or encoded payloads to profile update endpoints.
Deploy a Web Application Firewall (WAF) rule matching script tags and event handlers in Paid Memberships Pro form submissions.

Monitoring Recommendations

Alert on creation of privileged WordPress users following subscriber-level authentication events.
Monitor for unexpected JavaScript execution or DOM modifications on member profile pages using Content Security Policy (CSP) violation reports.
Track plugin version inventory across WordPress deployments and flag hosts running Paid Memberships Pro 3.8.1 or earlier.

How to Mitigate CVE-2026-15016

Immediate Actions Required

Update the Paid Memberships Pro plugin to a version later than 3.8.1 as soon as a patched release is available. Confirm the fixed version via the Paid Memberships Pro Release Notes.
Audit existing user meta and profile field data for stored HTML or JavaScript content and remove malicious entries.
Rotate credentials for administrator accounts that may have viewed compromised profile pages.

Patch Information

Refer to the Paid Memberships Pro Release Notes for the fixed version and remediation details. The Wordfence Vulnerability Report tracks the vulnerability under identifier 02e3f64c-1076-4247-9ee5-c1105edcfb39.

Workarounds

Restrict subscriber-level registration on affected sites until the plugin is patched.
Remove or disable the [pmpro_member_profile_edit] shortcode from pages that render user-controlled fields.
Deploy a WAF rule to block HTML tags and JavaScript event handlers in profile field submissions.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts on WordPress front-end pages.

bash

# Configuration example: strict CSP header via .htaccess to reduce XSS impact
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"