Simple Membership
Vendor:
First CVE: Jul 28, 2019 · Active for 6 years
20
Total CVEs
More Total CVEs than 95% of tracked products
5.0
Avg CVEs / Year
Higher CVE frequency than 89% of tracked products
6.9
Avg CVSS
Higher Avg CVSS than 43% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Simple Membership over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jul 28, 2019
6 years ago
Most Recent CVE
Nov 21, 2024
614 days ago
CVE Severity & Scoring
Simple Membership20 CVEs
65%
25%
10%
All CVEs353,173 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network20 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low20 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None5 (25.0%)
Unknown0 (0.0%)
Required15 (75.0%)
Privileges Required
Low5 (25.0%)
High0 (0.0%)
None15 (75.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (20 CVEs).
20 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-14328HIGH The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section. | Jul 28, 2019 | 8.8 | 39 | NO | YES |
CVE-2022-1724MEDIUM The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Sc | Jun 13, 2022 | 6.1 | 31 | NO | YES |
CVE-2023-41957CRITICAL Improper Privilege Management vulnerability in smp7, wp.Insider Simple Membership allows Privilege Escalation.This issue affects Simple Membership: from n/a through 4.3.4. | May 17, 2024 | 9.8 | 27 | NO | NO |
CVE-2022-2273HIGH The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membe | Aug 1, 2022 | 8.8 | 27 | NO | NO |
CVE-2023-41956HIGH Improper Authentication vulnerability in smp7, wp.Insider Simple Membership.This issue affects Simple Membership: from n/a through 4.3.4. | May 17, 2024 | 8.8 | 26 | NO | NO |
CVE-2016-10884HIGH The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues. | Aug 14, 2019 | 8.8 | 26 | NO | NO |
CVE-2022-2317CRITICAL The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter. | Aug 1, 2022 | 9.8 | 24 | NO | NO |
CVE-2022-0681MEDIUM The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged in admin delete arbit | Mar 21, 2022 | 6.5 | 22 | NO | NO |
CVE-2024-11088HIGH The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via the WordPress core search feature. This m | Nov 21, 2024 | 7.5 | 20 | NO | NO |
CVE-2022-4469MEDIUM The Simple Membership WordPress plugin before 4.2.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users w | Jan 16, 2023 | 5.4 | 20 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (20 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
1 CVE
5.0% of CVEs· 97th percentile
ExploitDB
1 CVE
5.0% of CVEs· 86th percentile
Social Chatter
Signals from CVEs in this product scope (20 CVEs).
Media Mentions
Signals from CVEs in this product scope (20 CVEs).
Top CNAs Publishing CVEs For Simple Membership
Top CWEs
Versions
No cataloged versions.