User Registration Membership (Unknown) - vulnerabilities (CVEs)
14 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2026-09-13. Vendor: Unknown.
CVEs of User Registration Membership
- CVE-2026-80072 - CVSS 4.7 (medium), 2026-09-13: The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing…
- CVE-2026-86407 - CVSS 3.7 (low), 2026-09-13: The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account…
- CVE-2026-86406 - CVSS 7.5 (high), 2026-09-13: The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate…
- CVE-2026-80071 - CVSS 7.2 (high), 2026-09-13: The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user…
- CVE-2026-79995 - CVSS 4.3 (medium), 2026-08-28: The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the…
- CVE-2026-79996 - CVSS 7.2 (high), 2026-08-28: The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated…
- CVE-2026-16736 - CVSS 7.5 (high), 2026-08-05: The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing registration-form…
- CVE-2026-11961 - CVSS 8.1 (high), 2026-07-17: The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public registration is one of the…
- CVE-2026-11966 - CVSS 5.3 (medium), 2026-07-17: The User Registration & Membership WordPress plugin before 5.2.3 does not perform a capability check for unauthenticated callers on one of its membership…
- CVE-2026-11964 - CVSS 9.1 (critical), 2026-07-13: The User Registration & Membership WordPress plugin before 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before…
- CVE-2026-11963 - CVSS 8.1 (high), 2026-07-13: The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a membership-upgrade action and derives the user…
- CVE-2026-11965 - CVSS 6.5 (medium), 2026-07-02: The User Registration & Membership WordPress plugin before 5.2.0 does not enforce payment completion before activating a paid membership subscription,…
- CVE-2025-2594 - CVSS 8.1 (high), 2025-04-22: The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled,…
- CVE-2025-2563 - CVSS 8.1 (high), 2025-04-14: The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled,…
