Extension WordPress
Vulnérabilités Simple Membership
Cette page rassemble les failles publiées pour Simple Membership, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Simple Membership
28 fiches
Simple Membership <= 4.7.5 – Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook
The Simple Membership plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This…
*-4.7.5
4.7.6
17/06/2026
Simple Membership <= 4.7.2 – Unauthenticated Stored Cross-Site Scripting
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
*-4.7.2
4.7.3
03/05/2026
Simple Membership <= 4.7.1 – Missing Authorization
The Simple Membership plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.7.1. This makes it possible for unauthenticated attackers to perform an…
*-4.7.1
4.7.2
31/03/2026
Simple Membership <= 4.7.0 – Unauthenticated Improper Handling of Missing Values
The Simple Membership plugin for WordPress is vulnerable to Improper Handling of Missing Values in all versions up to, and including, 4.7.0 via the Stripe webhook handler. This is due to the plugin only validating webhook signatures when…
*-4.7.0
4.7.1
18/02/2026
Simple Membership <= 4.6.9 – Missing Authorization
The Simple Membership plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.6.9. This makes it possible for authenticated attackers, with Subscriber-level access…
*-4.6.9
4.7.0
19/01/2026
Simple Membership <= 4.6.3 – Authenticated (Administrator+) Stored Cross-Site Scripting
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and…
*-4.6.3
4.6.4
05/06/2025
Simple Membership <= 4.5.5 – Exposure of Private Personal Information to an Unauthorized Actor
The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from…
*-4.5.5
4.5.6
20/11/2024
Simple Membership <= 4.5.3 – Unauthenticated Open Redirect
The Simple Membership plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 4.5.3. This is due to insufficient validation on the redirect url supplied. This makes it possible for unauthenticated attackers to…
*-4.5.3
4.5.4
21/10/2024
Simple Membership <= 4.4.5 – Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_link' shortcode in all versions up to, and including, 4.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This…
*-4.4.5
4.4.6
03/05/2024
Simple Membership <= 4.4.3 – Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_link' shortcode in all versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This…
*-4.4.3
4.4.4
24/04/2024
Simple Membership <= 4.4.2 – Unauthenticated Stored Self-Based Cross-Site Scripting
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping. This makes it possible for…
*-4.4.2
4.4.3
05/03/2024
Simple Membership <= 4.4.1 – Open Redirect
The Simple Membership plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 4.4.1. This is due to insufficient validation on the redirect url supplied via the swpm_page_url parameter. This makes it possible…
*-4.4.1
4.4.2
19/01/2024
Simple Membership <= 4.3.8 – Reflected Cross-Site Scripting
The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown parameter in all versions up to 4.3.9 (exclusive) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers…
[*, 4.3.9)
4.3.9
19/12/2023
Simple Membership <= 4.3.8 – Reflected Cross-Site Scripting Vulnerability via environment_mode
The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘environment_mode’ parameter in all versions up to, and including, 4.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
*-4.3.8
4.3.9
18/12/2023
Simple Membership <= 4.3.4 – Account Takeover via Password Reset
The Simple Membership plugin for WordPress is vulnerable to account takeover due to missing input validation on the process_password_reset_using_link function in versions up to, and including, 4.3.4. This makes it possible for authenticated attackers to gain access to…
*-4.3.4
4.3.5
25/09/2023
Simple Membership <= 4.3.4 – Privilege escalation via Registration
The Simple Membership plugin for WordPress is vulnerable to privilege escalation due to missing input validation on the create_swpm_user function in versions up to, and including, 4.3.4. This makes it possible for unauthenticated attackers to register users with…
*-4.3.4
4.3.5
25/09/2023
Simple Membership <= 4.3.5 – Reflected Cross-Site Scripting
The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `list_type` parameter in versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. Using this vulnerability, unauthenticated attackers could inject…
*-4.3.5
4.3.6
05/09/2023
Simple Membership <= 4.2.1 – Authenticated (Contributor+) Cross Site Scripting via shortcode
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode in versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level…
*-4.2.1
4.2.2
21/12/2022
Simple Membership <= 4.1.2 – Membership Privilege Escalation
The Simple Membership plugin for WordPress is vulnerable to membership related privilege escalation in versions up to, and including, 4.1.2. This is due to insufficient validation on the membership membership_level supplied which makes it possible for authenticated users…
*-4.1.2
4.1.3
06/07/2022
Simple Membership <= 4.1.2 – Membership Privilege Escalation
The Simple Membership plugin for WordPress is vulnerable to membership related privilege escalation in versions up to, and including, 4.1.2. This is due to insufficient validation on the membership level_identifier supplied which makes it possible for unauthenticated users…
*-4.1.2
4.1.3
06/07/2022
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.