VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 5 known issues Latest disclosed Jun 27, 2025

MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet Vulnerabilities

Review known vulnerability records for the WordPress plugin MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet (`paid-membership`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2025-5937, CVE-2025-31075 and CVE-2025-26579, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
5
High or Critical
0
Patch Coverage
100%
Last Updated
Feb 26, 2026
Priority CVE Quick Links

Fast paths into MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
5
CVE-2025-31075 Medium 2.9.30
CVE-2025-31075 MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet Stored Cross-Site Scripting

MicroPayments <= 2.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting

CVE-2024-13391 Medium 2.9.30
CVE-2024-13391 MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet Stored Cross-Site Scripting

MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet <= 2.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting

CVE-2025-26579 Medium 3.2.5
CVE-2025-26579 MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet Cross-Site Scripting

MicroPayments <= 3.2.4 - Reflected Cross-Site Scripting

CVE-2022-27629 Medium 1.9.6
CVE-2022-27629 MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet Cross-Site Request Forgery

MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership <= 1.9.5 - Cross-Site Request Forgery

CVE-2025-5937 Medium 3.2.1
CVE-2025-5937 MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet Cross-Site Request Forgery

MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.0 - Cross-Site Request Forgery to Settings Reset

Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
5 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
0 critical and 0 high severity findings.
Recent CVEs
CVE-2025-5937, CVE-2025-31075 and CVE-2025-26579
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2025-5937
CVE-2025-5937: MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.0 - Cross-Site Request Forgery to Settings Reset

The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the adminOptions() function....

Published
Jun 27, 2025
Patched Release
3.2.1
Affected Versions
Versions up to 3.2.0
Next Step
Update to 3.2.1 or newer if supported.
Open CVE-2025-5937 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-31075
CVE-2025-31075: MicroPayments <= 2.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting

The MicroPayments plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to...

Published
Mar 28, 2025
Patched Release
2.9.30
Affected Versions
Versions up to 2.9.29
Next Step
Update to 2.9.30 or newer if supported.
Open CVE-2025-31075 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-26579
CVE-2025-26579: MicroPayments <= 3.2.4 - Reflected Cross-Site Scripting

The MicroPayments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

Published
Mar 12, 2025
Patched Release
3.2.5
Affected Versions
Versions up to 3.2.4
Next Step
Update to 3.2.5 or newer if supported.
Open CVE-2025-26579 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-13391
CVE-2024-13391: MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet <= 2.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting

The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_content_upload_guest' shortcode in all versions up to, and including, 2.9.29 due to insuffi...

Published
Jan 17, 2025
Patched Release
2.9.30
Affected Versions
Versions up to 2.9.29
Next Step
Update to 2.9.30 or newer if supported.
Open CVE-2024-13391 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2022-27629
CVE-2022-27629: MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership <= 1.9.5 - Cross-Site Request Forgery

MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership versions prior to 1.9.6 are vulnerable to Cross-site request forgery. This allows a remote unauthenticated attacker to hijack the authentication of an administrator and perform unintended operation via unsp...

Published
Apr 20, 2022
Patched Release
1.9.6
Affected Versions
Versions up to 1.9.5
Next Step
Update to 1.9.6 or newer if supported.
Open CVE-2022-27629 Report Open CVE Reference