Simple Membership (Unknown) - vulnerabilities (CVEs)
12 CVEs, 1 in the last 30 days, 1 known versions, newest CVE from 2026-10-11. Vendor: Unknown.
CVEs of Simple Membership
- CVE-2026-88785 - CVSS 4.7 (medium), 2026-10-11: The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an…
- CVE-2026-88764 - CVSS 5.4 (medium), 2026-09-13: The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level…
- CVE-2026-14936 - CVSS 5.3 (medium), 2026-08-06: The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account…
- CVE-2026-15931 - CVSS 6.1 (medium), 2026-08-03: The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor…
- CVE-2026-15930 - CVSS 9.4 (critical), 2026-08-03: The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user…
- CVE-2026-11855 - CVSS 8.8 (high), 2026-07-06: The Simple Membership WordPress plugin before 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor…
- CVE-2022-4469 - CVSS 5.4 (medium), 2023-01-16: The Simple Membership WordPress plugin before 4.2.2 does not validate and escape some of its shortcode attributes before outputting them back in the page,…
- CVE-2022-2317 - CVSS 9.8 (critical), 2022-08-01: The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user…
- CVE-2022-2273 - CVSS 8.8 (high), 2022-08-01: The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to…
- CVE-2022-1724 - CVSS 6.1 (medium), 2022-06-13: The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to…
- CVE-2022-0681 - CVSS 6.5 (medium), 2022-03-21: The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged…
- CVE-2022-0328 - CVSS 4.7 (medium), 2022-02-28: The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in…
