CVE-2022-4830: Paid Memberships Pro WordPress plugin shortcode stored XSS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityCVSS is medium at 5.4 and requires authenticated contributor access plus victim interaction, though public exploit references and high EPSS raise the practical risk.

What it is

The Paid Memberships Pro WordPress plugin before 2.9.9 fails to validate and escape certain shortcode attributes before rendering them back into the page. This allows stored cross-site scripting, where injected script persists and executes in the browser of any user viewing the affected content.

Impact

An attacker with contributor-level access can inject persistent JavaScript that runs in the context of higher-privileged users such as administrators, enabling session theft or privileged actions in the admin's browser.

Attack surface

Reached over the network through crafted shortcode attributes submitted by an authenticated user with a role as low as contributor. Exploitation requires the victim to view the affected page, so some user interaction is needed.

Exploitation

Not listed in CISA KEV, but EPSS is high at 0.65006 (99.2nd percentile) and both references are tagged Exploit, indicating public exploit information exists.

What to do

• Update Paid Memberships Pro to version 2.9.9 or later.
• Restrict contributor and other low-privilege accounts until patched.
• Audit existing posts and pages for injected shortcode attributes or unexpected script content.
• Apply a web application firewall rule to block script payloads in shortcode attributes.

Detection

• Search post and page content for shortcode attributes containing script tags or event handlers.
• Monitor for new or modified content created by contributor-level accounts.
• Review web server and application logs for requests submitting shortcode attributes with encoded script payloads.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.