WordPress plugin
MemberHero – Simple User Registration & Login security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical3
- High4
- Medium1
- Low0
All MemberHero – Simple User Registration & Login vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.3 | Unauthenticated Privilege Escalation ≤6.9No patch available | CVE-2026-10522 | |
| High8.8 | Authenticated (Subscriber+) Privilege Escalation via profile_save_field ≤6.7Update to 6.8 | CVE-2026-0844 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤6.6Update to 6.7 | CVE-2025-12160 | |
| High8.8 | Authenticated (Contributor+) Privilege Escalation ≤6.4No patch available | CVE-2025-53428 | |
| Critical9.8 | Unauthenticated Privilege Escalation ≤6.3Update to 6.4 | CVE-2025-4334 | |
| Critical9.1 | Missing Authorization to User Deletion ≤5.5Update to 6.0 | CVE-2024-53810 | |
| Critical9.8 | Missing Authorization to Account Takeover ≤6.7Update to 6.8 | CVE-2024-49604 |
- High7.3Unauthenticated Privilege Escalation
≤6.9No patch available
- High8.8Authenticated (Subscriber+) Privilege Escalation via profile_save_field
≤6.7Update to 6.8
- High7.2Unauthenticated Stored Cross-Site Scripting
≤6.6Update to 6.7
- High8.8Authenticated (Contributor+) Privilege Escalation
≤6.4No patch available
- Critical9.8Unauthenticated Privilege Escalation
≤6.3Update to 6.4
- Critical9.1Missing Authorization to User Deletion
≤5.5Update to 6.0
- Critical9.8Missing Authorization to Account Takeover
≤6.7Update to 6.8
MemberHero – Simple User Registration & Login: common questions
Does MemberHero – Simple User Registration & Login have known vulnerabilities?
Yes. VulnCrest Radar lists 8 known vulnerabilities in MemberHero – Simple User Registration & Login: 3 critical, 4 high, 1 medium. At least one is not fixed in the latest version.
How do I check which version of MemberHero – Simple User Registration & Login I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent MemberHero – Simple User Registration & Login vulnerability?
CVE-2026-94235, published Oct 8, 2026: Simple User Registration <= 6.9 - Missing Authorization. Severity: Medium (CVSS 4.3).
Is any MemberHero – Simple User Registration & Login vulnerability listed in CISA KEV?
No. None of the known MemberHero – Simple User Registration & Login vulnerabilities is currently listed in the CISA KEV catalog.