Plugin security history

Simple Membership Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 28 vulnerability records associated with Simple Membership, published between 2016 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

28Total records

1Critical

9High

18Medium

0Low

0Informational

28Patched records

0Currently marked unpatched

2016-07-14First disclosure

2026-06-17Latest disclosure

26 of 28CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2016	2	2 records
2017	1	1 records
2019	1	1 records
2021	1	1 records
2022	6	6 records
2023	5	5 records
2024	6	6 records
2025	1	1 records
2026	5	5 records

Severity Breakdown

Severity	Records	Share
Critical	1	3.6%
High	9	32.1%
Medium	18	64.3%

Vulnerability-Type Breakdown

Cross-Site Scripting

12 records42.9%

First: 2016. Latest: 2026.

CSRF

4 records14.3%

First: 2016. Latest: 2022.

Other

4 records14.3%

First: 2023. Latest: 2026.

Privilege Escalation

3 records10.7%

First: 2022. Latest: 2023.

Missing Authorization

3 records10.7%

First: 2026. Latest: 2026.

SQL Injection

1 record3.6%

First: 2021. Latest: 2021.

Information Disclosure

1 record3.6%

First: 2024. Latest: 2024.

Patch Status

Patched: 28
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

4.7.6
4.7.3
4.7.2
4.7.1
4.7.0
4.6.4
4.5.6
4.5.4
4.4.6
4.4.4
4.4.3
4.4.2
4.3.9
4.3.5
4.3.6
4.2.2
4.1.3
4.1.1
4.1.0
4.0.9
4.0.4
3.8.5
3.5.7
3.3.3
3.2.9

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-4.7.5`	Simple Membership <= 4.7.5 - Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook	June 17, 2026	4.7.6	Medium
`*-4.7.2`	Simple Membership <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting	May 3, 2026	4.7.3	High
`*-4.7.1`	Simple Membership <= 4.7.1 - Missing Authorization	March 31, 2026	4.7.2	Medium
`*-4.7.0`	Simple Membership <= 4.7.0 - Unauthenticated Improper Handling of Missing Values	February 18, 2026	4.7.1	Medium
`*-4.6.9`	Simple Membership <= 4.6.9 - Missing Authorization	January 19, 2026	4.7.0	Medium
`*-4.6.3`	Simple Membership <= 4.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting	June 5, 2025	4.6.4	Medium
`*-4.5.5`	Simple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized Actor	November 20, 2024	4.5.6	Medium
`*-4.5.3`	Simple Membership <= 4.5.3 - Unauthenticated Open Redirect	October 21, 2024	4.5.4	Medium
`*-4.4.5`	Simple Membership <= 4.4.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode	May 3, 2024	4.4.6	Medium
`*-4.4.3`	Simple Membership <= 4.4.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode	April 24, 2024	4.4.4	Medium
`*-4.4.2`	Simple Membership <= 4.4.2 - Unauthenticated Stored Self-Based Cross-Site Scripting	March 5, 2024	4.4.3	Medium
`*-4.4.1`	Simple Membership <= 4.4.1 - Open Redirect	January 19, 2024	4.4.2	Medium
`[*, 4.3.9)`	Simple Membership <= 4.3.8 - Reflected Cross-Site Scripting	December 19, 2023	4.3.9	Medium
`*-4.3.8`	Simple Membership <= 4.3.8 - Reflected Cross-Site Scripting Vulnerability via environment_mode	December 18, 2023	4.3.9	Medium
`*-4.3.4`	Simple Membership <= 4.3.4 - Account Takeover via Password Reset	September 25, 2023	4.3.5	High
`*-4.3.4`	Simple Membership <= 4.3.4 - Privilege escalation via Registration	September 25, 2023	4.3.5	High
`*-4.3.5`	Simple Membership <= 4.3.5 - Reflected Cross-Site Scripting	September 5, 2023	4.3.6	High
`*-4.2.1`	Simple Membership <= 4.2.1 - Authenticated (Contributor+) Cross Site Scripting via shortcode	December 21, 2022	4.2.2	Medium
`*-4.1.2`	Simple Membership <= 4.1.2 - Membership Privilege Escalation	July 6, 2022	4.1.3	High
`*-4.1.2`	Simple Membership <= 4.1.2 - Membership Privilege Escalation	July 6, 2022	4.1.3	Critical
`*-4.1.0`	Simple Membership <= 4.1.0 - Reflected Cross-Site Scripting	May 23, 2022	4.1.1	Medium
`[*, 4.1.0)`	Simple Membership <= 4.0.9 - Cross-Site Request Forgery to Arbitrary Transaction Deletion	February 25, 2022	4.1.0	Medium
`[*, 4.0.9)`	Simple Membership <= 4.0.8 - Cross-Site Request Forgery to Arbitrary Member Deletion	January 25, 2022	4.0.9	High
`*-4.0.3`	Simple Membership <= 4.0.3 - Authenticated (Admin+) SQL Injections	April 5, 2021	4.0.4	High
`[*, 3.8.5)`	Simple Membership <= 3.8.4 - Cross-Site Request Forgery	July 27, 2019	3.8.5	High

Selected source records

Latest Records

MediumCVE-2026-12093

Simple Membership <= 4.7.5 - Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook

Published: June 17, 2026

Affected versions: *-4.7.5
Patched versions: 4.7.6

Original Wordfence record

HighCVE-2026-42663

Simple Membership <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting

Published: May 3, 2026

Affected versions: *-4.7.2
Patched versions: 4.7.3

Original Wordfence record

MediumCVE-2026-34886

Simple Membership <= 4.7.1 - Missing Authorization

Published: March 31, 2026

Affected versions: *-4.7.1
Patched versions: 4.7.2

Original Wordfence record

MediumCVE-2026-1461

Simple Membership <= 4.7.0 - Unauthenticated Improper Handling of Missing Values

Published: February 18, 2026

Affected versions: *-4.7.0
Patched versions: 4.7.1

Original Wordfence record

MediumCVE-2026-25308

Simple Membership <= 4.6.9 - Missing Authorization

Published: January 19, 2026

Affected versions: *-4.6.9
Patched versions: 4.7.0

Original Wordfence record

MediumCVE-2025-49333

Simple Membership <= 4.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: June 5, 2025

Affected versions: *-4.6.3
Patched versions: 4.6.4

Original Wordfence record

MediumCVE-2024-11088

Simple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized Actor

Published: November 20, 2024

Affected versions: *-4.5.5
Patched versions: 4.5.6

Original Wordfence record

MediumCVE-2024-49682

Simple Membership <= 4.5.3 - Unauthenticated Open Redirect

Published: October 21, 2024

Affected versions: *-4.5.3
Patched versions: 4.5.4

Original Wordfence record

Highest-Severity Records

CriticalCVE-2022-2317

Simple Membership <= 4.1.2 - Membership Privilege Escalation

Published: July 6, 2022

Affected versions: *-4.1.2
Patched versions: 4.1.3

Original Wordfence record

HighCVE-2016-10884

Simple Membership <= 3.3.2 - Multiple Cross-Site Request Forgery

Published: September 16, 2016

Affected versions: *-3.3.2
Patched versions: 3.3.3

Original Wordfence record

HighCVE-2022-0328

Simple Membership <= 4.0.8 - Cross-Site Request Forgery to Arbitrary Member Deletion

Published: January 25, 2022

Affected versions: [*, 4.0.9)
Patched versions: 4.0.9

Original Wordfence record

HighCVE-2022-2273

Simple Membership <= 4.1.2 - Membership Privilege Escalation

Published: July 6, 2022

Affected versions: *-4.1.2
Patched versions: 4.1.3

Original Wordfence record

HighCVE-2019-14328

Simple Membership <= 3.8.4 - Cross-Site Request Forgery

Published: July 27, 2019

Affected versions: [*, 3.8.5)
Patched versions: 3.8.5

Original Wordfence record

HighCVE-2023-41956

Simple Membership <= 4.3.4 - Account Takeover via Password Reset

Published: September 25, 2023

Affected versions: *-4.3.4
Patched versions: 4.3.5

Original Wordfence record

HighCVE-2023-41957

Simple Membership <= 4.3.4 - Privilege escalation via Registration

Published: September 25, 2023

Affected versions: *-4.3.4
Patched versions: 4.3.5

Original Wordfence record

High

Simple Membership <= 4.0.3 - Authenticated (Admin+) SQL Injections

Published: April 5, 2021

Affected versions: *-4.0.3
Patched versions: 4.0.4

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory