Simple Membership Plugin Simple Membership
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Simple Membership Plugin Simple Membership.
By the Year
In 2026 there have been 0 vulnerabilities in Simple Membership Plugin Simple Membership. Simple Membership did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 0 | 0.00 |
| 2024 | 9 | 6.58 |
| 2023 | 3 | 6.23 |
| 2022 | 5 | 7.18 |
| 2021 | 0 | 0.00 |
| 2020 | 0 | 0.00 |
| 2019 | 3 | 8.80 |
It may take a day or so for new Simple Membership vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Simple Membership Plugin Simple Membership Security Vulnerabilities
Info Exposure in WordPress Simple Membership 4.5.5 via Search
CVE-2024-11088
5.3 - Medium
- November 21, 2024
The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Information Disclosure
Open Redirect in WP Simple Membership <=4.5.3
CVE-2024-49682
- October 24, 2024
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wp.insider Simple Membership simple-membership allows Phishing.This issue affects Simple Membership: from n/a through <= 4.5.3.
Open Redirect
Improper Auth in WP.SimpleMembership before 4.3.4
CVE-2023-41956
8.8 - High
- May 17, 2024
Improper Authentication vulnerability in smp7, wp.Insider Simple Membership.This issue affects Simple Membership: from n/a through 4.3.4.
authentification
Simple Membership WP Plugin Privilege Escalation (4.3.4)
CVE-2023-41957
9.8 - Critical
- May 17, 2024
Improper Privilege Management vulnerability in smp7, wp.Insider Simple Membership allows Privilege Escalation.This issue affects Simple Membership: from n/a through 4.3.4.
Improper Privilege Management
WordPress Simple Memb. Stored XSS via swpm_paypal_subscription_cancel_link (4.4.5)
CVE-2024-4383
6.4 - Medium
- May 14, 2024
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_link' shortcode in all versions up to, and including, 4.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
XSS
WP Simple Membership <=4.4.3 Stored XSS via swpm_paypal_sub_cancel_link
CVE-2024-3730
5.4 - Medium
- April 25, 2024
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_link' shortcode in all versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
XSS
CVE-2024-1985: WP Simple Membership 4.4.2 Stored XSS via Display Name
CVE-2024-1985
4.7 - Medium
- March 13, 2024
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability requires social engineering to successfully exploit, and the impact would be very limited due to the attacker requiring a user to login as the user with the injected payload for execution.
XSS
Open Redirect in Simple Membership <=4.4.1
CVE-2024-22308
6.1 - Medium
- January 24, 2024
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in smp7, wp.Insider Simple Membership.This issue affects Simple Membership: from n/a through 4.4.1.
Open Redirect
WP Simple Membership XSS via environment_mode (4.3.8)
CVE-2023-6882
6.1 - Medium
- January 11, 2024
The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the environment_mode parameter in all versions up to, and including, 4.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
XSS
WordPress Simple Membership 4.3.8 Reflected XSS CVE-2023-50376
CVE-2023-50376
6.1 - Medium
- December 19, 2023
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smp7, wp.Insider Simple Membership allows Reflected XSS.This issue affects Simple Membership: from n/a through 4.3.8.
XSS
WP Simple Membership <=4.3.5 Reflected XSS via list_type
CVE-2023-4719
7.2 - High
- September 06, 2023
The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `list_type` parameter in versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. Using this vulnerability, unauthenticated attackers could inject arbitrary web scripts into pages that are being executed if they can successfully trick a user into taking an action, such as clicking a malicious link.
XSS
Simple Membership WP Plugin v<4.2.2 - Stored XSS via shortcodes
CVE-2022-4469
5.4 - Medium
- January 16, 2023
The Simple Membership WordPress plugin before 4.2.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
XSS
Simple Membership WP <=4.1.2: Unchecked membership_level causes PrivEsc via POST
CVE-2022-2273
8.8 - High
- August 01, 2022
The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request.
Improper Privilege Management
Simple Membership WP Plugin <=4.1.3: Membership Change via Parameter Bypass
CVE-2022-2317
9.8 - Critical
- August 01, 2022
The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter.
Improper Privilege Management
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions
CVE-2022-1724
6.1 - Medium
- June 13, 2022
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting
XSS
The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could
CVE-2022-0681
6.5 - Medium
- March 21, 2022
The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged in admin delete arbitrary transactions via a CSRF attack
Session Riding
The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could
CVE-2022-0328
4.7 - Medium
- February 28, 2022
The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack
Session Riding
The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.
CVE-2016-10884
8.8 - High
- August 14, 2019
The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.
Session Riding
The simple-membership plugin before 3.5.7 for WordPress has XSS.
CVE-2017-18499
- August 12, 2019
The simple-membership plugin before 3.5.7 for WordPress has XSS.
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section.
CVE-2019-14328
- July 28, 2019
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section.
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Simple Membership Plugin Simple Membership or by Simple Membership Plugin? Click the Watch button to subscribe.
