{"id":"CVE-2026-119521","kind":"vulnerability","aliases":["CVE-2026-119521"],"related":[],"title":"Paid Member Subscriptions WordPress plugin: stored XSS through version 3.1.3","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Stored XSS.This issue affects Paid Member Subscriptions: from n/a through 3.1.3.","summary":"The Paid Member Subscriptions plugin for WordPress by Cozmoslabs has a stored cross-site scripting flaw in versions up to and including 3.1.3. An attacker can plant script that runs in other users' browsers when they view the affected page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","paid-member-subscriptions","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Paid Member Subscriptions plugin version in the WordPress admin under Plugins, and compare it with `3.1.3`.","fix":"- Paid Member Subscriptions: a fixed version is not stated in the sources; move to a release later than `3.1.3` once the vendor publishes one.","status":"open","published_at":"2026-11-03T17:18:06+00:00","first_seen_at":"2026-11-03T17:21:55+00:00","triaged_at":"2026-11-03T17:24:11+00:00","updated_at":"2026-11-03T17:24:11+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T17:24:11Z","model":"claude-haiku-5-5","output":{"fix":"- Paid Member Subscriptions: a fixed version is not stated in the sources; move to a release later than `3.1.3` once the vendor publishes one.","reach":"internet","title":"Paid Member Subscriptions WordPress plugin: stored XSS through version 3.1.3","impact":"medium","summary":"The Paid Member Subscriptions plugin for WordPress by Cozmoslabs has a stored cross-site scripting flaw in versions up to and including 3.1.3. An attacker can plant script that runs in other users' browsers when they view the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","paid-member-subscriptions","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers, possibly admin sessions.","analyst_note":"Confirm the fixed version and the affected input path from the vendor advisory or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-119521.","how_to_check":"- Check the installed Paid Member Subscriptions plugin version in the WordPress admin under Plugins, and compare it with `3.1.3`.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Paid Member Subscriptions WordPress plugin at version 3.1.3 or earlier. The sources do not say which pages or user roles expose the stored input, so unknown which configurations are most at risk.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00071,"input_tokens":4138,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119521':13A,16A '-2026':12A,15A '3.1.3':10A,49B,100C 'affect':65B,93C 'allow':89C 'attack':51B 'browser':60B 'cozmoslab':34B,81C 'cross':39B,76C 'cross-sit':38B,75C 'cve':11A,14A 'flaw':42B 'generat':74C 'host':24B 'improp':67C 'includ':48B 'input':70C 'issu':92C 'member':2A,20B,28B,83C,87C,95C 'n/a':98C 'neutral':68C 'packag':17B 'page':66B,73C 'paid':1A,19B,27B,82C,86C,94C 'paid-member-subscript':18B,85C 'plant':53B 'plugin':5A,30B 'run':56B 'script':41B,54B,78C 'self':23B 'self-host':22B 'site':40B,77C 'store':6A,37B,90C 'subscript':3A,21B,29B,84C,88C,96C 'user':59B 'version':9A,44B 'view':63B 'vulner':79C 'web':72C 'wordpress':4A,25B,32B 'xss':7A 'xss.this':91C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Paid Member Subscriptions WordPress plugin at version 3.1.3 or earlier. The sources do not say which pages or user roles expose the stored input, so unknown which configurations are most at risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","paidmembersubscriptions","selfhosted","wordpress"],"campaign_type":null,"first_public_at":"2026-11-03T17:18:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119521","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119521","severity":null,"published_at":"2026-11-03T17:18:06+00:00","modified_at":"2026-11-03T17:18:06+00:00","first_seen_at":"2026-11-03T17:21:55+00:00","fetched_at":"2026-11-03T17:21:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}