Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

Simple Membership Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 28 vulnerability records associated with Simple Membership, published between 2016 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

28Total records
1Critical
9High
18Medium
0Low
0Informational
28Patched records
0Currently marked unpatched
2016-07-14First disclosure
2026-06-17Latest disclosure
26 of 28CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
201622 records
201711 records
201911 records
202111 records
202266 records
202355 records
202466 records
202511 records
202655 records

Severity Breakdown

SeverityRecordsShare
Critical13.6%
High932.1%
Medium1864.3%

Vulnerability-Type Breakdown

Cross-Site Scripting

12 records42.9%

First: 2016. Latest: 2026.

CSRF

4 records14.3%

First: 2016. Latest: 2022.

Other

4 records14.3%

First: 2023. Latest: 2026.

Privilege Escalation

3 records10.7%

First: 2022. Latest: 2023.

Missing Authorization

3 records10.7%

First: 2026. Latest: 2026.

SQL Injection

1 record3.6%

First: 2021. Latest: 2021.

Information Disclosure

1 record3.6%

First: 2024. Latest: 2024.

Patch Status

Patched
28
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 4.7.6
  • 4.7.3
  • 4.7.2
  • 4.7.1
  • 4.7.0
  • 4.6.4
  • 4.5.6
  • 4.5.4
  • 4.4.6
  • 4.4.4
  • 4.4.3
  • 4.4.2
  • 4.3.9
  • 4.3.5
  • 4.3.6
  • 4.2.2
  • 4.1.3
  • 4.1.1
  • 4.1.0
  • 4.0.9
  • 4.0.4
  • 3.8.5
  • 3.5.7
  • 3.3.3
  • 3.2.9

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
[*, 3.5.7)Simple Membership <= 3.5.6 - Cross-Site ScriptingNovember 8, 20173.5.7Medium
*-3.3.2Simple Membership <= 3.3.2 - Multiple Cross-Site Request ForgerySeptember 16, 20163.3.3High
[*, 3.2.9)Simple Membership < 3.2.9 - Reflected Cross-Site ScriptingJuly 14, 20163.2.9Medium

Selected source records

Latest Records

MediumCVE-2026-12093

Simple Membership <= 4.7.5 - Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook

Published: June 17, 2026

Affected versions
*-4.7.5
Patched versions
4.7.6
Original Wordfence record
HighCVE-2026-42663

Simple Membership <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting

Published: May 3, 2026

Affected versions
*-4.7.2
Patched versions
4.7.3
Original Wordfence record
MediumCVE-2026-34886

Simple Membership <= 4.7.1 - Missing Authorization

Published: March 31, 2026

Affected versions
*-4.7.1
Patched versions
4.7.2
Original Wordfence record
MediumCVE-2026-1461

Simple Membership <= 4.7.0 - Unauthenticated Improper Handling of Missing Values

Published: February 18, 2026

Affected versions
*-4.7.0
Patched versions
4.7.1
Original Wordfence record
MediumCVE-2026-25308

Simple Membership <= 4.6.9 - Missing Authorization

Published: January 19, 2026

Affected versions
*-4.6.9
Patched versions
4.7.0
Original Wordfence record
MediumCVE-2025-49333

Simple Membership <= 4.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: June 5, 2025

Affected versions
*-4.6.3
Patched versions
4.6.4
Original Wordfence record
MediumCVE-2024-11088

Simple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized Actor

Published: November 20, 2024

Affected versions
*-4.5.5
Patched versions
4.5.6
Original Wordfence record
MediumCVE-2024-49682

Simple Membership <= 4.5.3 - Unauthenticated Open Redirect

Published: October 21, 2024

Affected versions
*-4.5.3
Patched versions
4.5.4
Original Wordfence record

Highest-Severity Records

CriticalCVE-2022-2317

Simple Membership <= 4.1.2 - Membership Privilege Escalation

Published: July 6, 2022

Affected versions
*-4.1.2
Patched versions
4.1.3
Original Wordfence record
HighCVE-2016-10884

Simple Membership <= 3.3.2 - Multiple Cross-Site Request Forgery

Published: September 16, 2016

Affected versions
*-3.3.2
Patched versions
3.3.3
Original Wordfence record
HighCVE-2022-0328

Simple Membership <= 4.0.8 - Cross-Site Request Forgery to Arbitrary Member Deletion

Published: January 25, 2022

Affected versions
[*, 4.0.9)
Patched versions
4.0.9
Original Wordfence record
HighCVE-2022-2273

Simple Membership <= 4.1.2 - Membership Privilege Escalation

Published: July 6, 2022

Affected versions
*-4.1.2
Patched versions
4.1.3
Original Wordfence record
HighCVE-2019-14328

Simple Membership <= 3.8.4 - Cross-Site Request Forgery

Published: July 27, 2019

Affected versions
[*, 3.8.5)
Patched versions
3.8.5
Original Wordfence record
HighCVE-2023-41956

Simple Membership <= 4.3.4 - Account Takeover via Password Reset

Published: September 25, 2023

Affected versions
*-4.3.4
Patched versions
4.3.5
Original Wordfence record
HighCVE-2023-41957

Simple Membership <= 4.3.4 - Privilege escalation via Registration

Published: September 25, 2023

Affected versions
*-4.3.4
Patched versions
4.3.5
Original Wordfence record
High

Simple Membership <= 4.0.3 - Authenticated (Admin+) SQL Injections

Published: April 5, 2021

Affected versions
*-4.0.3
Patched versions
4.0.4
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory