Simple Membership < 4.0.9 - Arbitrary Member Deletion via CSRF

The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack

The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section.

The simple-membership plugin before 3.5.7 for WordPress has XSS.

The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.