GCVE - cpe:2.3:a:unknown:simple_membership:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:simple_membership:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unknown (`668ca391-a6cc-5e33-879b-83885214de33`)
Product	Simple Membership (`5ada791a-e70b-5f44-ae30-017e23993d46`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-88764`	vulnerable	2026-09-16 04:34:09.211861	Simple Membership < 4.7.8 - Subscriber+ Membership Level Escalation via PayPal Standard subsc_ref The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing members to pay for a lower-priced membership while being granted a higher, more privileged membership level. Published: 2026-09-13T06:00:08.690Z Updated: 2026-09-13T10:44:51.651Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/54fdf46e-0385-40a3-b3bc-a862dc0fb03e/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-14936`	vulnerable	2026-09-16 04:33:11.877288	Simple Membership < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification MEDIUM (5.3) The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control. Published: 2026-08-06T17:04:20.749Z Updated: 2026-08-07T14:04:36.301Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/82ac8cd9-db44-49c7-905c-16d261c5c516/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-15930`	vulnerable	2026-09-16 04:33:06.952939	Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow. Published: 2026-08-03T06:00:12.870Z Updated: 2026-08-03T17:30:59.804Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/e46948f1-0e06-4e76-8fc8-df661eb786a5/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-15931`	vulnerable	2026-09-16 04:33:06.647887	Simple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes in an administrator's session. Published: 2026-08-03T06:00:13.051Z Updated: 2026-08-03T17:06:38.008Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/30779ecc-779c-4e7c-9e8b-278ddf343214/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-11855`	vulnerable	2026-07-29 00:23:31.731988	Simple Membership < 4.7.5 - Unauthenticated Stored XSS via Stripe Webhook API Version The Simple Membership WordPress plugin before 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escape a value taken from them before outputting it in an administrator notice, allowing unauthenticated attackers to inject arbitrary web scripts that execute in the context of a logged-in administrator. Published: 2026-07-06T06:00:01.657Z Updated: 2026-07-06T12:01:41.739Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/217cb606-a0f2-4427-9262-cfe1cc90474e/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-4469`	vulnerable	2026-06-08 05:51:59.543491	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-2317`	vulnerable	2026-06-08 05:43:35.291041	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-2273`	vulnerable	2026-06-08 05:43:35.170900	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-1724`	vulnerable	2026-06-08 05:39:13.794272	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-0681`	vulnerable	2026-06-08 05:39:10.533285	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-0328`	vulnerable	2026-06-08 05:39:09.732284	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.