Skip to content
OpenAdvisories

Vendor

wpinsider-1

13 known vulnerabilities.

Products

Simple Membership 11 Simple Membership WP user Import 1 Affiliates Manager 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2026-97337

    Simple Membership <= 4.8.3 - Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints

    The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via the resend-activation and email-activation endpoints. The endpoints are dispatched f…

    wpinsider-1 Simple Membership Web / CMS
  • High 7.2
    CVE-2023-4719

    Simple Membership <= 4.3.5 - Reflected Cross-Site Scripting

    The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `list_type` parameter in versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. Using this vulnerability, unauthentica…

    wpinsider-1 Simple Membership Web / CMS
  • High 7.2
    CVE-2023-0254

    Simple Membership WP user Import <= 1.7 - Authenticated (Admin+) SQL Injection

    The Simple Membership WP user Import plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter. This makes it possible for authenticated at…

    wpinsider-1 Simple Membership WP user Import Web / CMS