Skip to contentWpinsider-1 Simple Membership vulnerabilities
- unknown simple membershipSimple Membership < 4.8.3 - Newly Registered Member Password Disclosure via URL Query StringCVE-2026-887854.7 Medium
- wpinsider-1 simple membershipSimple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country FieldCVE-2026-1034276.4 Medium
- wpinsider-1 simple membershipSimple Membership <= 4.8.3 - Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation EndpointsCVE-2026-973377.5 High
- wp.insider simple membershipWordPress Simple Membership plugin <= 4.8.2 - Broken Access Control vulnerabilityCVE-2026-740005.3 Medium
- unknown simple membershipSimple Membership < 4.7.8 - Subscriber+ Membership Level Escalation via PayPal Standard subsc_refCVE-2026-887645.4 Medium
- wpinsider-1 simple membershipSimple Membership <= 4.8.1 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity BindingCVE-2026-771945.3 Medium
- unknown simple membershipSimple Membership < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver VerificationCVE-2026-149365.3 Medium
- wp.insider simple membershipWordPress Simple Membership plugin <= 4.7.8 - Broken Access Control vulnerabilityCVE-2026-667127.5 High
- unknown simple membershipSimple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber NameCVE-2026-159316.1 Medium
- unknown simple membershipSimple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username CollisionCVE-2026-159309.4 Critical
- unknown simple membershipSimple Membership < 4.7.5 - Unauthenticated Stored XSS via Stripe Webhook API VersionCVE-2026-118558.8 High
- wpinsider-1 simple membershipSimple Membership <= 4.7.5 - Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' WebhookCVE-2026-120935.3 Medium
- wp.insider simple membershipWordPress Simple Membership plugin <= 4.7.2 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-426636.5 Medium
- wp.insider simple membershipWordPress Simple Membership plugin <= 4.7.1 - Broken Access Control vulnerabilityCVE-2026-348867.5 High
- wpinsider-1 simple membershipSimple Membership <= 4.7.0 - Unauthenticated Improper Handling of Missing ValuesCVE-2026-14616.5 Medium
- wp.insider simple membershipWordPress Simple Membership plugin <= 4.6.9 - Broken Access Control vulnerabilityCVE-2026-253084.3 Medium
- wp.insider simple membershipWordPress Simple Membership plugin <= 4.6.3 - Cross Site Scripting (XSS) VulnerabilityCVE-2025-493335.9 Medium
- mra13 simple membershipSimple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized ActorCVE-2024-110885.3 Medium
- simple-membership-plugin simple membershipWordPress Simple Membership plugin <= 4.5.3 - Open Redirection vulnerabilityCVE-2024-496824.7 Medium
- simple-membership-plugin simple membershipWordPress Simple Membership plugin <= 4.3.4 - Unauthenticated Membership Role Privilege Escalation vulnerabilityCVE-2023-419578.6 High
- simple-membership-plugin simple membershipWordPress Simple Membership plugin <= 4.3.4 - Authenticated Account Takeover vulnerabilityCVE-2023-419568.8 High
- simple-membership-plugin simple membershipSimple Membership <= 4.4.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via ShortcodeCVE-2024-43836.4 Medium
- simple-membership-plugin simple membershipSimple Membership <= 4.4.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via ShortcodeCVE-2024-37305.4 Medium
- simple-membership-plugin simple membershipSimple Membership <= 4.4.2 - Unauthenticated Stored Self-Based Cross-Site ScriptingCVE-2024-19854.7 Medium
- simple-membership-plugin simple membershipWordPress Simple Membership Plugin <= 4.4.1 is vulnerable to Open RedirectionCVE-2024-223083.4 Low
- simple-membership-plugin simple membershipSimple Membership <= 4.3.8 - Reflected Cross-Site Scripting Vulnerability via environment_modeCVE-2023-68826.1 Medium
- simple-membership-plugin simple membershipWordPress Simple Membership Plugin <= 4.3.8 is vulnerable to Unauth. Reflected Cross Site Scripting (XSS)CVE-2023-503767.1 High
- simple-membership-plugin simple membershipSimple Membership <= 4.3.5 - Reflected Cross-Site ScriptingCVE-2023-47197.2 High
- simple-membership-plugin simple membershipSimple Membership < 4.2.2 - Contributor+ Stored XSSCVE-2022-44695.4 Medium
- simple-membership-plugin simple membership wp user importSimple Membership WP user Import <= 1.7 - Authenticated (Admin+) SQL InjectionCVE-2023-02547.2 High
- simple-membership-plugin simple membershipSimple Membership < 4.1.3 - Unauthenticated Membership Privilege EscalationCVE-2022-23179.8 Critical
- simple-membership-plugin simple membershipSimple Membership < 4.1.3 - Membership Privilege EscalationCVE-2022-22738.8 High
- simple-membership-plugin simple membershipSimple Membership < 4.1.1 - Reflected Cross-Site ScriptingCVE-2022-17246.1 Medium
- simple-membership-plugin simple membershipSimple Membership < 4.1.0 - Arbitrary Transaction Deletion via CSRFCVE-2022-06816.5 Medium
- simple-membership-plugin simple membershipSimple Membership < 4.0.9 - Arbitrary Member Deletion via CSRFCVE-2022-03284.7 Medium