WordPress plugin
Simple Membership security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 39 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High12
- Medium25
- Low1
All Simple Membership vulnerabilities
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field
≤4.8.4Update to 4.8.5
- Low3.1Information Exposure
≤4.8.2Update to 4.8.3
- High7.5Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints
≤4.8.3Update to 4.8.4
- Medium4.3Missing Authorization
≤4.8.2Update to 4.8.3
- Medium4.3Missing Authorization
<4.7.8Update to 4.7.8
- Medium5.3Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding
≤4.8.1Update to 4.8.2
- Medium5.3Missing Authorization
≤4.7.8Update to 4.7.9
- Medium5.3Missing Authorization
≤4.7.7Update to 4.7.8
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.7.7Update to 4.7.8
- Medium5.3Unauthenticated Payment Verification Bypass
≤4.7.6Update to 4.7.7
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook
≤4.7.5Update to 4.7.6
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.7.4Update to 4.7.5
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.7.2Update to 4.7.3
- Medium5.3Missing Authorization
≤4.7.1Update to 4.7.2
- Medium6.5Unauthenticated Improper Handling of Missing Values
≤4.7.0Update to 4.7.1
- Medium4.3Missing Authorization
≤4.6.9Update to 4.7.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤4.6.3Update to 4.6.4
- Medium5.3Exposure of Private Personal Information to an Unauthorized Actor
≤4.5.5Update to 4.5.6
- Medium6.1Unauthenticated Open Redirect
≤4.5.3Update to 4.5.4
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
≤4.4.5Update to 4.4.6
- Medium5.4Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
≤4.4.3Update to 4.4.4
- Medium4.7Unauthenticated Stored Self-Based Cross-Site Scripting
≤4.4.2Update to 4.4.3
- Medium6.1Open Redirect
≤4.4.1Update to 4.4.2
- Medium6.1Reflected Cross-Site Scripting
<4.3.9Update to 4.3.9
- Medium6.1Reflected Cross-Site Scripting Vulnerability via environment_mode
≤4.3.8Update to 4.3.9
- High8.8Account Takeover via Password Reset
≤4.3.4Update to 4.3.5
- High7.3Privilege escalation via Registration
≤4.3.4Update to 4.3.5
- High7.2Reflected Cross-Site Scripting
≤4.3.5Update to 4.3.6
- Medium6.4Authenticated (Contributor+) Cross Site Scripting via shortcode
≤4.2.1Update to 4.2.2
- High8.8Membership Privilege Escalation
≤4.1.2Update to 4.1.3
- Critical9.8Membership Privilege Escalation
≤4.1.2Update to 4.1.3
- Medium6.1Reflected Cross-Site Scripting
≤4.1.0Update to 4.1.1
- Medium6.5Cross-Site Request Forgery to Arbitrary Transaction Deletion
<4.1.0Update to 4.1.0
- High8.8Cross-Site Request Forgery to Arbitrary Member Deletion
<4.0.9Update to 4.0.9
- High7.2Authenticated (Admin+) SQL Injections
≤4.0.3Update to 4.0.4
- High8.8Cross-Site Request Forgery
<3.8.5Update to 3.8.5
- Medium6.1Cross-Site Scripting
<3.5.7Update to 3.5.7
- High8.8Multiple Cross-Site Request Forgery
≤3.3.2Update to 3.3.3
- Medium6.1Reflected Cross-Site Scripting
<3.2.9Update to 3.2.9
Simple Membership: common questions
Does Simple Membership have known vulnerabilities?
Yes. VulnCrest Radar lists 39 known vulnerabilities in Simple Membership: 1 critical, 12 high, 25 medium, 1 low. None are known to affect version null.
How do I check which version of Simple Membership I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Simple Membership vulnerability?
CVE-2026-103427, published Oct 9, 2026: Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field. Severity: Medium (CVSS 6.4).
Is any Simple Membership vulnerability listed in CISA KEV?
No. None of the known Simple Membership vulnerabilities is currently listed in the CISA KEV catalog.