Simple Membership Plugin is a narrowly scoped WordPress membership and user-management plugin that, despite limited product breadth, ranks among the more prominent WordPress security concerns in the vulnerability landscape. The plugin's vulnerability footprint centers on its core membership functionality and user-import features, though the specific weakness patterns driving the exposures have not coalesced into a dominant recurring class. Defenders tracking WordPress security should monitor this plugin's update cadence alongside broader WordPress plugin trends, as even modestly represented exposures in widely installed plugins can affect substantial deployment populations. Live severity, exploitation, and current CVE counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Simple Membership Plugin over time
Signals from CVEs in this vendor scope (21 CVEs).
21 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-14328HIGH The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section. | Jul 28, 2019 | 8.8 | 39 | NO | YES |
CVE-2022-1724MEDIUM The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Sc | Jun 13, 2022 | 6.1 | 31 | NO | YES |
CVE-2023-41957CRITICAL Improper Privilege Management vulnerability in smp7, wp.Insider Simple Membership allows Privilege Escalation.This issue affects Simple Membership: from n/a through 4.3.4. | May 17, 2024 | 9.8 | 27 | NO | NO |
CVE-2022-2273HIGH The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membe | Aug 1, 2022 | 8.8 | 27 | NO | NO |
CVE-2023-41956HIGH Improper Authentication vulnerability in smp7, wp.Insider Simple Membership.This issue affects Simple Membership: from n/a through 4.3.4. | May 17, 2024 | 8.8 | 26 | NO | NO |
CVE-2016-10884HIGH The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues. | Aug 14, 2019 | 8.8 | 26 | NO | NO |
CVE-2022-2317CRITICAL The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter. | Aug 1, 2022 | 9.8 | 24 | NO | NO |
CVE-2022-0681MEDIUM The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged in admin delete arbit | Mar 21, 2022 | 6.5 | 22 | NO | NO |
CVE-2024-11088HIGH The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via the WordPress core search feature. This m | Nov 21, 2024 | 7.5 | 20 | NO | NO |
CVE-2022-4469MEDIUM The Simple Membership WordPress plugin before 4.2.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users w | Jan 16, 2023 | 5.4 | 20 | NO | NO |
Signals from CVEs in this vendor scope (21 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Simple Membership Plugin.
Media articles that mention a CVE ID that affects a product developed by Simple Membership Plugin — matched by CVE ID, not by vendor name.