CVE-2026-15016 is a stored cross-site scripting vulnerability in the Paid Memberships Pro plugin for WordPress, specifically in the Content Restriction, User Registration, & Paid Subscriptions component. The vulnerability arises from improper neutralization of input in the Readonly User Field rendered by the [pmpro_member_profile_edit] shortcode. Authenticated attackers with subscriber-level privileges can inject arbitrary scripts that persist and execute in the context of other users viewing the injected content. This is due to insufficient input sanitization and output escaping in all plugin versions up to and including 3.8.1.

An attacker with subscriber-level access or higher can inject malicious JavaScript code that executes in the browsers of users who view the affected pages. This can lead to information disclosure, session hijacking, or other actions permitted by the victim's browser context. The vulnerability does not affect availability and requires authentication with low privileges, but the impact on confidentiality and integrity is limited to the scope of the injected scripts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions as much as possible and monitor for suspicious activity. Avoid using the [pmpro_member_profile_edit] shortcode in environments where untrusted users have subscriber-level access. Follow updates from strangerstudios for any official patches or workarounds.