CVE-2026-39514: WordPress Paid Member Subscriptions plugin <= 2.17.3 - Reflected Cross Site Scripting (XSS) vulnerability

Synopsis

Reflected Cross-Site Scripting (XSS) in the Cozmoslabs Paid Member Subscriptions WordPress plugin affects all versions up to and including 2.17.3. The vulnerability is reachable over the network with no authentication required, but does need a victim to follow or load a specially crafted link. Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the victim's browser session, enabling session theft, credential harvesting, and limited content tampering. No upstream fix has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the WordPress site over the network and deliver a crafted URL or request to the target.

• AuthenticationNot required

  No account or credentials are needed; the vulnerability is exploitable by any unauthenticated party.

• Victim interactionRequired

  A victim must click a malicious link or load a crafted page for the injected script to execute in their browser.

• Attack complexityDetail

  The exploit is reliable and requires no special conditions, race timing, or environmental configuration to succeed.

Blast Radius

• Reads session cookies or authentication tokens from the victim's browser, enabling session hijacking.
• Harvests credentials or sensitive form input by injecting keyloggers or fake login prompts into the page.
• Modifies visible page content in the victim's browser to facilitate phishing or social-engineering follow-on attacks.
• Triggers limited availability disruption by redirecting the victim away from legitimate site functionality.