SM
Product
Simple Membership
11
CVEs
0
On KEV
7.5
Max CVSS
2
New 30D
Severity mix
Critical 0High 2Medium 9Low 0
Watch
Add Simple Membership to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-97337 | 7.5 | Oct 3 | Simple Membership <= 4.8.3 - Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints Affected: through 4.8.3 |
| CVE-2024-11088 | 7.5 | Nov 21 | Simple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized Actor Affected: through 4.5.5 |
| CVE-2026-1461 | 6.5 | Feb 19 | Simple Membership <= 4.7.0 - Unauthenticated Improper Handling of Missing Values Affected: through 4.7.0 |
| CVE-2026-103427 | 6.4 | Oct 10 | Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field Affected: through 4.8.4 |
| CVE-2024-1985 | 6.1 | Mar 13 | Simple Membership <= 4.4.2 - Unauthenticated Stored Self-Based Cross-Site Scripting Affected: through 4.4.2 |
| CVE-2023-6882 | 6.1 | Jan 11 | Simple Membership <= 4.3.8 - Reflected Cross-Site Scripting Vulnerability via environment_mode Affected: through 4.3.8 |
| CVE-2023-4719 | 6.1 | Sep 6 | Simple Membership <= 4.3.5 - Reflected Cross-Site Scripting Affected: through 4.3.5 |
| CVE-2024-4383 | 5.4 | May 9 | Simple Membership <= 4.4.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode Affected: through 4.4.5 |
| CVE-2024-3730 | 5.4 | Apr 25 | Simple Membership <= 4.4.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode Affected: through 4.4.3 |
| CVE-2026-77194 | 5.3 | Sep 1 | Simple Membership <= 4.8.1 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding Affected: through 4.8.1 |
| CVE-2026-12093 | 5.3 | Jun 18 | Simple Membership <= 4.7.5 - Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook Affected: through 4.7.5 |
Showing 11