Simple Membership
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:simple_membership:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Simple Membership (5ada791a-e70b-5f44-ae30-017e23993d46) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-11855 |
vulnerable | 2026-07-29 00:23:31.731988 |
Simple Membership < 4.7.5 - Unauthenticated Stored XSS via Stripe Webhook API Version
The Simple Membership WordPress plugin before 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escape a value taken from them before outputting it in an administrator notice, allowing unauthenticated attackers to inject arbitrary web scripts that execute in the context of a logged-in administrator.
Published: 2026-07-06T06:00:01.657Z
Updated: 2026-07-06T12:01:41.739Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4469 |
vulnerable | 2026-06-08 05:51:59.543491 |
Simple Membership < 4.2.2 - Contributor+ Stored XSS
The Simple Membership WordPress plugin before 4.2.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
Published: 2023-01-16T15:37:43.390Z
Updated: 2025-04-08T19:32:43.711Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-2317 |
vulnerable | 2026-06-08 05:43:35.291041 |
Simple Membership < 4.1.3 - Unauthenticated Membership Privilege Escalation
The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter.
Published: 2022-08-01T12:52:01.000Z
Updated: 2024-08-03T00:32:09.549Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-2273 |
vulnerable | 2026-06-08 05:43:35.170900 |
Simple Membership < 4.1.3 - Membership Privilege Escalation
The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request.
Published: 2022-08-01T12:51:22.000Z
Updated: 2024-08-03T00:32:09.608Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-1724 |
vulnerable | 2026-06-08 05:39:13.794272 |
Simple Membership < 4.1.1 - Reflected Cross-Site Scripting
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting
Published: 2022-06-13T12:42:31.000Z
Updated: 2024-08-03T00:16:58.963Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0681 |
vulnerable | 2026-06-08 05:39:10.533285 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0328 |
vulnerable | 2026-06-08 05:39:09.732284 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.