Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24

Export CSV
CVE-2026-14936

Simple Membership < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification

The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Simple-membership-plugin Wordpress
Products
Simple Membership Wordpress
CVE-2026-15930

Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision

The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Simple-membership-plugin Wordpress
Products
Simple Membership Wordpress
CVE-2026-15931

Simple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name

The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes in an administrator's session.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Simple-membership-plugin Wordpress
Products
Simple Membership Wordpress
CVE-2024-22308

WordPress Simple Membership Plugin <= 4.4.1 is vulnerable to Open Redirection

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in smp7, wp.Insider Simple Membership.This issue affects Simple Membership: from n/a through 4.4.1.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed
Vendors
Simple-membership-plugin
Products
Simple Membership
CVE-2023-50376

WordPress Simple Membership Plugin <= 4.3.8 is vulnerable to Unauth. Reflected Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smp7, wp.Insider Simple Membership allows Reflected XSS.This issue affects Simple Membership: from n/a through 4.3.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Simple-membership-plugin
Products
Simple Membership
CVE-2024-49682

WordPress Simple Membership plugin <= 4.5.3 - Open Redirection vulnerability

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wp.insider Simple Membership simple-membership allows Phishing.This issue affects Simple Membership: from n/a through <= 4.5.3.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Simple-membership-plugin
Products
Simple Membership
CVE-2023-4719

Simple Membership <= 4.3.5 - Reflected Cross-Site Scripting

The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `list_type` parameter in versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. Using this vulnerability, unauthenticated attackers could inject arbitrary web scripts into pages that are being executed if they can successfully trick a user into taking an action, such as clicking a malicious link.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Simple-membership-plugin
Products
Simple Membership
CVE-2024-4383

Simple Membership <= 4.4.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_link' shortcode in all versions up to, and including, 4.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Simple-membership-plugin
Products
Simple Membership
CVE-2024-3730

Simple Membership <= 4.4.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_link' shortcode in all versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Simple-membership-plugin Wordpress
Products
Simple Membership Simple Membership
CVE-2024-1985

Simple Membership <= 4.4.2 - Unauthenticated Stored Self-Based Cross-Site Scripting

The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability requires social engineering to successfully exploit, and the impact would be very limited due to the attacker requiring a user to login as the user with the injected payload for execution.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Simple-membership-plugin
Products
Simple Membership
CVE-2023-6882

Simple Membership <= 4.3.8 - Reflected Cross-Site Scripting Vulnerability via environment_mode

The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘environment_mode’ parameter in all versions up to, and including, 4.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Simple-membership-plugin
Products
Simple Membership
CVE-2023-0254

Simple Membership WP user Import <= 1.7 - Authenticated (Admin+) SQL Injection

The Simple Membership WP user Import plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter. This makes it possible for authenticated attackers with administrative privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Simple-membership-plugin
Products
Simple Membership Wp User Import
CVE-2024-11088

Simple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized Actor

The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mra13 Simple-membership-plugin
Products
Simple Membership Simple Membership
CVE-2022-4469

Simple Membership < 4.2.2 - Contributor+ Stored XSS

The Simple Membership WordPress plugin before 4.2.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Simple-membership-plugin
Products
Simple Membership
CVE-2022-2317

Simple Membership < 4.1.3 - Unauthenticated Membership Privilege Escalation

The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed
Vendors
Simple-membership-plugin
Products
Simple Membership
CVE-2022-2273

Simple Membership < 4.1.3 - Membership Privilege Escalation

The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Simple-membership-plugin
Products
Simple Membership
CVE-2022-1724

Simple Membership < 4.1.1 - Reflected Cross-Site Scripting

The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS 1.8% KEV · Not listed
Vendors
Simple-membership-plugin
Products
Simple Membership
CVE-2022-0681

Simple Membership < 4.1.0 - Arbitrary Transaction Deletion via CSRF

The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged in admin delete arbitrary transactions via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Simple-membership-plugin
Products
Simple Membership