Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-14936 (GCVE-0-2026-14936)

Vulnerability from nvd – Published: 2026-08-06 17:04 – Updated: 2026-08-07 14:04

Title

Simple Membership < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification

Summary

The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-07 14:04 UTC

CWE

CWE-345 Insufficient Verification of Data Authenticity
CWE-345 - Insufficient Verification of Data Authenticity

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/82ac8cd9-db44-49…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Simple Membership	Affected: 0 , < 4.7.7 (semver)

Credits

Muni Nitish Kumar Yaddala WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14936",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-07T14:04:12.970470Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-345",
                "description": "CWE-345 Insufficient Verification of Data Authenticity",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-07T14:04:36.301Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "Simple Membership",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.7.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Muni Nitish Kumar Yaddala"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site\u0027s own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-345 Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-06T17:04:20.749Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/82ac8cd9-db44-49c7-905c-16d261c5c516/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Simple Membership \u003c 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-14936",
    "datePublished": "2026-08-06T17:04:20.749Z",
    "dateReserved": "2026-07-07T11:50:26.844Z",
    "dateUpdated": "2026-08-07T14:04:36.301Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15931 (GCVE-0-2026-15931)

Vulnerability from nvd – Published: 2026-08-03 06:00 – Updated: 2026-08-03 17:06

Title

Simple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name

Summary

The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes in an administrator's session.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 17:06 UTC

CWE

CWE-79 Cross-Site Scripting (XSS)
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/30779ecc-779c-4e…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Simple Membership	Affected: 0 , < 4.7.8 (semver)

Credits

Yaswanth Reddy Sunkara WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-15931",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T17:06:13.133023Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T17:06:38.008Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Simple Membership",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.7.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yaswanth Reddy Sunkara"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes in an administrator\u0027s session."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T06:00:13.051Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/30779ecc-779c-4e7c-9e8b-278ddf343214/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Simple Membership \u003c 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-15931",
    "datePublished": "2026-08-03T06:00:13.051Z",
    "dateReserved": "2026-07-16T07:28:24.341Z",
    "dateUpdated": "2026-08-03T17:06:38.008Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15930 (GCVE-0-2026-15930)

Vulnerability from nvd – Published: 2026-08-03 06:00 – Updated: 2026-08-03 17:30

Title

Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision

Summary

The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.

Severity

9.4 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 17:16 UTC

CWE

CWE-862 Missing Authorization
CWE-862 - Missing Authorization

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/e46948f1-0e06-4e…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Simple Membership	Affected: 0 , < 4.7.8 (semver)

Credits

Brandon Steed WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.4,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "LOW",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-15930",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T17:16:42.878273Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-862",
                "description": "CWE-862 Missing Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T17:30:59.804Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Simple Membership",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.7.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Brandon Steed"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator\u0027s account data (including the email address) and take over that account through the password reset flow."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T06:00:12.870Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/e46948f1-0e06-4e76-8fc8-df661eb786a5/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Simple Membership \u003c 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-15930",
    "datePublished": "2026-08-03T06:00:12.870Z",
    "dateReserved": "2026-07-16T07:28:21.275Z",
    "dateUpdated": "2026-08-03T17:30:59.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-11855 (GCVE-0-2026-11855)

Vulnerability from nvd – Published: 2026-07-06 06:00 – Updated: 2026-07-06 12:01

Title

Simple Membership < 4.7.5 - Unauthenticated Stored XSS via Stripe Webhook API Version

Summary

The Simple Membership WordPress plugin before 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escape a value taken from them before outputting it in an administrator notice, allowing unauthenticated attackers to inject arbitrary web scripts that execute in the context of a logged-in administrator.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-06 12:01 UTC

CWE

CWE-79 Cross-Site Scripting (XSS)

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/217cb606-a0f2-44…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Simple Membership	Affected: 0 , < 4.7.5 (semver)

Credits

Duy Tran WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-11855",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-06T12:01:19.019388Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-06T12:01:41.739Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Simple Membership",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.7.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Duy Tran"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Simple Membership WordPress plugin before 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escape a value taken from them before outputting it in an administrator notice, allowing unauthenticated attackers to inject arbitrary web scripts that execute in the context of a logged-in administrator."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-06T06:00:01.657Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/217cb606-a0f2-4427-9262-cfe1cc90474e/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Simple Membership \u003c 4.7.5 - Unauthenticated Stored XSS via Stripe Webhook API Version",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-11855",
    "datePublished": "2026-07-06T06:00:01.657Z",
    "dateReserved": "2026-06-10T08:56:17.436Z",
    "dateUpdated": "2026-07-06T12:01:41.739Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-4469 (GCVE-0-2022-4469)

Vulnerability from nvd – Published: 2023-01-16 15:37 – Updated: 2025-04-08 19:32

Title

Simple Membership < 4.2.2 - Contributor+ Stored XSS

Summary

The Simple Membership WordPress plugin before 4.2.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-08 19:32 UTC

CWE

CWE-79 Cross-Site Scripting (XSS)

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/b195c373-1db9-4f…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Simple Membership	Affected: 0 , < 4.2.2 (custom)

Credits

Lana Codes WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:41:44.709Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "exploit",
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/b195c373-1db9-4fd7-98d0-0860dacd189e"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-4469",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T19:32:08.815579Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T19:32:43.711Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "Simple Membership",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Lana Codes"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Simple Membership WordPress plugin before 4.2.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-16T15:37:43.390Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/b195c373-1db9-4fd7-98d0-0860dacd189e"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Simple Membership \u003c 4.2.2 - Contributor+ Stored XSS",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-4469",
    "datePublished": "2023-01-16T15:37:43.390Z",
    "dateReserved": "2022-12-14T03:56:17.075Z",
    "dateUpdated": "2025-04-08T19:32:43.711Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-2317 (GCVE-0-2022-2317)

Vulnerability from nvd – Published: 2022-08-01 12:52 – Updated: 2024-08-03 00:32

Title

Simple Membership < 4.1.3 - Unauthenticated Membership Privilege Escalation

Summary

The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter.

Severity

No CVSS data available.

CWE

CWE-269 - Improper Privilege Management

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/77b7ca19-294c-44…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Unknown	Simple Membership	Affected: 4.1.3 , < 4.1.3 (custom)

Credits

Jet Infosystems

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:32:09.549Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/77b7ca19-294c-4480-8f57-6fddfc67fffb"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Simple Membership",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.1.3",
              "status": "affected",
              "version": "4.1.3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Jet Infosystems"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-01T12:52:01.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/77b7ca19-294c-4480-8f57-6fddfc67fffb"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Simple Membership \u003c 4.1.3 - Unauthenticated Membership Privilege Escalation",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2022-2317",
          "STATE": "PUBLIC",
          "TITLE": "Simple Membership \u003c 4.1.3 - Unauthenticated Membership Privilege Escalation"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Simple Membership",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "4.1.3",
                            "version_value": "4.1.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Jet Infosystems"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter."
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-269 Improper Privilege Management"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/77b7ca19-294c-4480-8f57-6fddfc67fffb",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/77b7ca19-294c-4480-8f57-6fddfc67fffb"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-2317",
    "datePublished": "2022-08-01T12:52:01.000Z",
    "dateReserved": "2022-07-05T00:00:00.000Z",
    "dateUpdated": "2024-08-03T00:32:09.549Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-2273 (GCVE-0-2022-2273)

Vulnerability from nvd – Published: 2022-08-01 12:51 – Updated: 2024-08-03 00:32

Title

Simple Membership < 4.1.3 - Membership Privilege Escalation

Summary

The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request.

Severity

No CVSS data available.

CWE

CWE-269 - Improper Privilege Management

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/724729d9-1c4a-48…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Unknown	Simple Membership	Affected: 4.1.3 , < 4.1.3 (custom)

Credits

Jet Infosystems

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:32:09.608Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/724729d9-1c4a-485c-9c90-a27664c47c84"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Simple Membership",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.1.3",
              "status": "affected",
              "version": "4.1.3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Jet Infosystems"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-01T12:51:22.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/724729d9-1c4a-485c-9c90-a27664c47c84"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Simple Membership \u003c 4.1.3 - Membership Privilege Escalation",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2022-2273",
          "STATE": "PUBLIC",
          "TITLE": "Simple Membership \u003c 4.1.3 - Membership Privilege Escalation"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Simple Membership",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "4.1.3",
                            "version_value": "4.1.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Jet Infosystems"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request."
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-269 Improper Privilege Management"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/724729d9-1c4a-485c-9c90-a27664c47c84",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/724729d9-1c4a-485c-9c90-a27664c47c84"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-2273",
    "datePublished": "2022-08-01T12:51:22.000Z",
    "dateReserved": "2022-06-30T00:00:00.000Z",
    "dateUpdated": "2024-08-03T00:32:09.608Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-1724 (GCVE-0-2022-1724)

Vulnerability from nvd – Published: 2022-06-13 12:42 – Updated: 2024-08-03 00:16

Title

Simple Membership < 4.1.1 - Reflected Cross-Site Scripting

Summary

The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting

Severity

No CVSS data available.

CWE

CWE-79 - Cross-site Scripting (XSS)

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/96a0a667-9c4b-4e…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Unknown	Simple Membership	Affected: 4.1.1 , < 4.1.1 (custom)

Credits

cydave

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:16:58.963Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/96a0a667-9c4b-4ea6-b78a-0681e9a9bbae"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Simple Membership",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.1.1",
              "status": "affected",
              "version": "4.1.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "cydave"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-06-13T12:42:31.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/96a0a667-9c4b-4ea6-b78a-0681e9a9bbae"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Simple Membership \u003c 4.1.1 - Reflected Cross-Site Scripting",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2022-1724",
          "STATE": "PUBLIC",
          "TITLE": "Simple Membership \u003c 4.1.1 - Reflected Cross-Site Scripting"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Simple Membership",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "4.1.1",
                            "version_value": "4.1.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "cydave"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting"
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Cross-site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/96a0a667-9c4b-4ea6-b78a-0681e9a9bbae",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/96a0a667-9c4b-4ea6-b78a-0681e9a9bbae"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-1724",
    "datePublished": "2022-06-13T12:42:31.000Z",
    "dateReserved": "2022-05-15T00:00:00.000Z",
    "dateUpdated": "2024-08-03T00:16:58.963Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-0681 (GCVE-0-2022-0681)

Vulnerability from nvd – Published: 2022-03-21 18:55 – Updated: 2024-08-02 23:40

Title

Simple Membership < 4.1.0 - Arbitrary Transaction Deletion via CSRF

Summary

The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged in admin delete arbitrary transactions via a CSRF attack

Severity

No CVSS data available.

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/c5765816-4439-4c…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Unknown	Simple Membership	Affected: 4.1.0 , < 4.1.0 (custom)

Credits

muhamad hidayat

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:40:03.160Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/c5765816-4439-4c14-a847-044248ada0ef"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Simple Membership",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.1.0",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "muhamad hidayat"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged in admin delete arbitrary transactions via a CSRF attack"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-21T18:55:56.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/c5765816-4439-4c14-a847-044248ada0ef"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Simple Membership \u003c 4.1.0 - Arbitrary Transaction Deletion via CSRF",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2022-0681",
          "STATE": "PUBLIC",
          "TITLE": "Simple Membership \u003c 4.1.0 - Arbitrary Transaction Deletion via CSRF"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Simple Membership",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "4.1.0",
                            "version_value": "4.1.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "muhamad hidayat"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged in admin delete arbitrary transactions via a CSRF attack"
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-352 Cross-Site Request Forgery (CSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/c5765816-4439-4c14-a847-044248ada0ef",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/c5765816-4439-4c14-a847-044248ada0ef"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-0681",
    "datePublished": "2022-03-21T18:55:56.000Z",
    "dateReserved": "2022-02-18T00:00:00.000Z",
    "dateUpdated": "2024-08-02T23:40:03.160Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-0328 (GCVE-0-2022-0328)

Vulnerability from nvd – Published: 2022-02-28 09:06 – Updated: 2024-08-02 23:25

Title

Simple Membership < 4.0.9 - Arbitrary Member Deletion via CSRF

Summary

The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack

Severity

No CVSS data available.

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

WPScan mitre root

References

2 references

URL	Tags
https://wpscan.com/vulnerability/44532b7c-4d0d-49…	x_refsource_MISC
https://plugins.trac.wordpress.org/changeset/2662855	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
Unknown	Simple Membership	Affected: 4.0.9 , < 4.0.9 (custom)

Credits

Krzysztof Zając

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:25:40.479Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/44532b7c-4d0d-4959-ada4-733f377d6ec9"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset/2662855"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Simple Membership",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.0.9",
              "status": "affected",
              "version": "4.0.9",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Krzysztof Zaj\u0105c"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-28T09:06:45.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/44532b7c-4d0d-4959-ada4-733f377d6ec9"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://plugins.trac.wordpress.org/changeset/2662855"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Simple Membership \u003c 4.0.9 - Arbitrary Member Deletion via CSRF",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2022-0328",
          "STATE": "PUBLIC",
          "TITLE": "Simple Membership \u003c 4.0.9 - Arbitrary Member Deletion via CSRF"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Simple Membership",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "4.0.9",
                            "version_value": "4.0.9"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Krzysztof Zaj\u0105c"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack"
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-352 Cross-Site Request Forgery (CSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/44532b7c-4d0d-4959-ada4-733f377d6ec9",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/44532b7c-4d0d-4959-ada4-733f377d6ec9"
            },
            {
              "name": "https://plugins.trac.wordpress.org/changeset/2662855",
              "refsource": "CONFIRM",
              "url": "https://plugins.trac.wordpress.org/changeset/2662855"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-0328",
    "datePublished": "2022-02-28T09:06:45.000Z",
    "dateReserved": "2022-01-21T00:00:00.000Z",
    "dateUpdated": "2024-08-02T23:25:40.479Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-14936 (GCVE-0-2026-14936)

Vulnerability from cvelistv5 – Published: 2026-08-06 17:04 – Updated: 2026-08-07 14:04

Title

Simple Membership < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification

Summary

The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-07 14:04 UTC

CWE

CWE-345 Insufficient Verification of Data Authenticity
CWE-345 - Insufficient Verification of Data Authenticity

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/82ac8cd9-db44-49…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Simple Membership	Affected: 0 , < 4.7.7 (semver)

Credits

Muni Nitish Kumar Yaddala WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14936",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-07T14:04:12.970470Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-345",
                "description": "CWE-345 Insufficient Verification of Data Authenticity",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-07T14:04:36.301Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "Simple Membership",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.7.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Muni Nitish Kumar Yaddala"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site\u0027s own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-345 Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-06T17:04:20.749Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/82ac8cd9-db44-49c7-905c-16d261c5c516/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Simple Membership \u003c 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-14936",
    "datePublished": "2026-08-06T17:04:20.749Z",
    "dateReserved": "2026-07-07T11:50:26.844Z",
    "dateUpdated": "2026-08-07T14:04:36.301Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15931 (GCVE-0-2026-15931)

Vulnerability from cvelistv5 – Published: 2026-08-03 06:00 – Updated: 2026-08-03 17:06

Title

Simple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name

Summary

The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes in an administrator's session.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 17:06 UTC

CWE

CWE-79 Cross-Site Scripting (XSS)
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/30779ecc-779c-4e…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Simple Membership	Affected: 0 , < 4.7.8 (semver)

Credits

Yaswanth Reddy Sunkara WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-15931",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T17:06:13.133023Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T17:06:38.008Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Simple Membership",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.7.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yaswanth Reddy Sunkara"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes in an administrator\u0027s session."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T06:00:13.051Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/30779ecc-779c-4e7c-9e8b-278ddf343214/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Simple Membership \u003c 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-15931",
    "datePublished": "2026-08-03T06:00:13.051Z",
    "dateReserved": "2026-07-16T07:28:24.341Z",
    "dateUpdated": "2026-08-03T17:06:38.008Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15930 (GCVE-0-2026-15930)

Vulnerability from cvelistv5 – Published: 2026-08-03 06:00 – Updated: 2026-08-03 17:30

Title

Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision

Summary

The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.

Severity

9.4 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 17:16 UTC

CWE

CWE-862 Missing Authorization
CWE-862 - Missing Authorization

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/e46948f1-0e06-4e…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Simple Membership	Affected: 0 , < 4.7.8 (semver)

Credits

Brandon Steed WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.4,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "LOW",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-15930",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T17:16:42.878273Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-862",
                "description": "CWE-862 Missing Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T17:30:59.804Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Simple Membership",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.7.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Brandon Steed"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator\u0027s account data (including the email address) and take over that account through the password reset flow."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T06:00:12.870Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/e46948f1-0e06-4e76-8fc8-df661eb786a5/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Simple Membership \u003c 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-15930",
    "datePublished": "2026-08-03T06:00:12.870Z",
    "dateReserved": "2026-07-16T07:28:21.275Z",
    "dateUpdated": "2026-08-03T17:30:59.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-11855 (GCVE-0-2026-11855)

Vulnerability from cvelistv5 – Published: 2026-07-06 06:00 – Updated: 2026-07-06 12:01

Title

Simple Membership < 4.7.5 - Unauthenticated Stored XSS via Stripe Webhook API Version

Summary

The Simple Membership WordPress plugin before 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escape a value taken from them before outputting it in an administrator notice, allowing unauthenticated attackers to inject arbitrary web scripts that execute in the context of a logged-in administrator.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-06 12:01 UTC

CWE

CWE-79 Cross-Site Scripting (XSS)

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/217cb606-a0f2-44…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Simple Membership	Affected: 0 , < 4.7.5 (semver)

Credits

Duy Tran WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-11855",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-06T12:01:19.019388Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-06T12:01:41.739Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Simple Membership",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.7.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Duy Tran"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Simple Membership WordPress plugin before 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escape a value taken from them before outputting it in an administrator notice, allowing unauthenticated attackers to inject arbitrary web scripts that execute in the context of a logged-in administrator."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-06T06:00:01.657Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/217cb606-a0f2-4427-9262-cfe1cc90474e/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Simple Membership \u003c 4.7.5 - Unauthenticated Stored XSS via Stripe Webhook API Version",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-11855",
    "datePublished": "2026-07-06T06:00:01.657Z",
    "dateReserved": "2026-06-10T08:56:17.436Z",
    "dateUpdated": "2026-07-06T12:01:41.739Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-4469 (GCVE-0-2022-4469)

Vulnerability from cvelistv5 – Published: 2023-01-16 15:37 – Updated: 2025-04-08 19:32

Title

Simple Membership < 4.2.2 - Contributor+ Stored XSS

Summary

The Simple Membership WordPress plugin before 4.2.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-08 19:32 UTC

CWE

CWE-79 Cross-Site Scripting (XSS)

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/b195c373-1db9-4f…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Simple Membership	Affected: 0 , < 4.2.2 (custom)

Credits

Lana Codes WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:41:44.709Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "exploit",
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/b195c373-1db9-4fd7-98d0-0860dacd189e"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-4469",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T19:32:08.815579Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T19:32:43.711Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "Simple Membership",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Lana Codes"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Simple Membership WordPress plugin before 4.2.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-16T15:37:43.390Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/b195c373-1db9-4fd7-98d0-0860dacd189e"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Simple Membership \u003c 4.2.2 - Contributor+ Stored XSS",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-4469",
    "datePublished": "2023-01-16T15:37:43.390Z",
    "dateReserved": "2022-12-14T03:56:17.075Z",
    "dateUpdated": "2025-04-08T19:32:43.711Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-2317 (GCVE-0-2022-2317)

Vulnerability from cvelistv5 – Published: 2022-08-01 12:52 – Updated: 2024-08-03 00:32

Title

Simple Membership < 4.1.3 - Unauthenticated Membership Privilege Escalation

Summary

The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter.

Severity

No CVSS data available.

CWE

CWE-269 - Improper Privilege Management

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/77b7ca19-294c-44…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Unknown	Simple Membership	Affected: 4.1.3 , < 4.1.3 (custom)

Credits

Jet Infosystems

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:32:09.549Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/77b7ca19-294c-4480-8f57-6fddfc67fffb"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Simple Membership",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.1.3",
              "status": "affected",
              "version": "4.1.3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Jet Infosystems"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-01T12:52:01.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/77b7ca19-294c-4480-8f57-6fddfc67fffb"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Simple Membership \u003c 4.1.3 - Unauthenticated Membership Privilege Escalation",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2022-2317",
          "STATE": "PUBLIC",
          "TITLE": "Simple Membership \u003c 4.1.3 - Unauthenticated Membership Privilege Escalation"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Simple Membership",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "4.1.3",
                            "version_value": "4.1.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Jet Infosystems"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter."
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-269 Improper Privilege Management"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/77b7ca19-294c-4480-8f57-6fddfc67fffb",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/77b7ca19-294c-4480-8f57-6fddfc67fffb"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-2317",
    "datePublished": "2022-08-01T12:52:01.000Z",
    "dateReserved": "2022-07-05T00:00:00.000Z",
    "dateUpdated": "2024-08-03T00:32:09.549Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-2273 (GCVE-0-2022-2273)

Vulnerability from cvelistv5 – Published: 2022-08-01 12:51 – Updated: 2024-08-03 00:32

Title

Simple Membership < 4.1.3 - Membership Privilege Escalation

Summary

The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request.

Severity

No CVSS data available.

CWE

CWE-269 - Improper Privilege Management

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/724729d9-1c4a-48…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Unknown	Simple Membership	Affected: 4.1.3 , < 4.1.3 (custom)

Credits

Jet Infosystems

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:32:09.608Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/724729d9-1c4a-485c-9c90-a27664c47c84"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Simple Membership",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.1.3",
              "status": "affected",
              "version": "4.1.3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Jet Infosystems"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-01T12:51:22.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/724729d9-1c4a-485c-9c90-a27664c47c84"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Simple Membership \u003c 4.1.3 - Membership Privilege Escalation",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2022-2273",
          "STATE": "PUBLIC",
          "TITLE": "Simple Membership \u003c 4.1.3 - Membership Privilege Escalation"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Simple Membership",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "4.1.3",
                            "version_value": "4.1.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Jet Infosystems"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request."
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-269 Improper Privilege Management"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/724729d9-1c4a-485c-9c90-a27664c47c84",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/724729d9-1c4a-485c-9c90-a27664c47c84"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-2273",
    "datePublished": "2022-08-01T12:51:22.000Z",
    "dateReserved": "2022-06-30T00:00:00.000Z",
    "dateUpdated": "2024-08-03T00:32:09.608Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-1724 (GCVE-0-2022-1724)

Vulnerability from cvelistv5 – Published: 2022-06-13 12:42 – Updated: 2024-08-03 00:16

Title

Simple Membership < 4.1.1 - Reflected Cross-Site Scripting

Summary

The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting

Severity

No CVSS data available.

CWE

CWE-79 - Cross-site Scripting (XSS)

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/96a0a667-9c4b-4e…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Unknown	Simple Membership	Affected: 4.1.1 , < 4.1.1 (custom)

Credits

cydave

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:16:58.963Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/96a0a667-9c4b-4ea6-b78a-0681e9a9bbae"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Simple Membership",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.1.1",
              "status": "affected",
              "version": "4.1.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "cydave"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-06-13T12:42:31.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/96a0a667-9c4b-4ea6-b78a-0681e9a9bbae"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Simple Membership \u003c 4.1.1 - Reflected Cross-Site Scripting",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2022-1724",
          "STATE": "PUBLIC",
          "TITLE": "Simple Membership \u003c 4.1.1 - Reflected Cross-Site Scripting"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Simple Membership",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "4.1.1",
                            "version_value": "4.1.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "cydave"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting"
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Cross-site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/96a0a667-9c4b-4ea6-b78a-0681e9a9bbae",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/96a0a667-9c4b-4ea6-b78a-0681e9a9bbae"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-1724",
    "datePublished": "2022-06-13T12:42:31.000Z",
    "dateReserved": "2022-05-15T00:00:00.000Z",
    "dateUpdated": "2024-08-03T00:16:58.963Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-0681 (GCVE-0-2022-0681)

Vulnerability from cvelistv5 – Published: 2022-03-21 18:55 – Updated: 2024-08-02 23:40

Title

Simple Membership < 4.1.0 - Arbitrary Transaction Deletion via CSRF

Summary

The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged in admin delete arbitrary transactions via a CSRF attack

Severity

No CVSS data available.

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/c5765816-4439-4c…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Unknown	Simple Membership	Affected: 4.1.0 , < 4.1.0 (custom)

Credits

muhamad hidayat

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:40:03.160Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/c5765816-4439-4c14-a847-044248ada0ef"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Simple Membership",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.1.0",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "muhamad hidayat"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged in admin delete arbitrary transactions via a CSRF attack"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-21T18:55:56.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/c5765816-4439-4c14-a847-044248ada0ef"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Simple Membership \u003c 4.1.0 - Arbitrary Transaction Deletion via CSRF",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2022-0681",
          "STATE": "PUBLIC",
          "TITLE": "Simple Membership \u003c 4.1.0 - Arbitrary Transaction Deletion via CSRF"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Simple Membership",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "4.1.0",
                            "version_value": "4.1.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "muhamad hidayat"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged in admin delete arbitrary transactions via a CSRF attack"
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-352 Cross-Site Request Forgery (CSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/c5765816-4439-4c14-a847-044248ada0ef",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/c5765816-4439-4c14-a847-044248ada0ef"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-0681",
    "datePublished": "2022-03-21T18:55:56.000Z",
    "dateReserved": "2022-02-18T00:00:00.000Z",
    "dateUpdated": "2024-08-02T23:40:03.160Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-0328 (GCVE-0-2022-0328)

Vulnerability from cvelistv5 – Published: 2022-02-28 09:06 – Updated: 2024-08-02 23:25

Title

Simple Membership < 4.0.9 - Arbitrary Member Deletion via CSRF

Summary

The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack

Severity

No CVSS data available.

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

WPScan mitre root

References

2 references

URL	Tags
https://wpscan.com/vulnerability/44532b7c-4d0d-49…	x_refsource_MISC
https://plugins.trac.wordpress.org/changeset/2662855	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
Unknown	Simple Membership	Affected: 4.0.9 , < 4.0.9 (custom)

Credits

Krzysztof Zając

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:25:40.479Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/44532b7c-4d0d-4959-ada4-733f377d6ec9"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset/2662855"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Simple Membership",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.0.9",
              "status": "affected",
              "version": "4.0.9",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Krzysztof Zaj\u0105c"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-28T09:06:45.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/44532b7c-4d0d-4959-ada4-733f377d6ec9"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://plugins.trac.wordpress.org/changeset/2662855"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Simple Membership \u003c 4.0.9 - Arbitrary Member Deletion via CSRF",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2022-0328",
          "STATE": "PUBLIC",
          "TITLE": "Simple Membership \u003c 4.0.9 - Arbitrary Member Deletion via CSRF"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Simple Membership",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "4.0.9",
                            "version_value": "4.0.9"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Krzysztof Zaj\u0105c"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack"
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-352 Cross-Site Request Forgery (CSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/44532b7c-4d0d-4959-ada4-733f377d6ec9",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/44532b7c-4d0d-4959-ada4-733f377d6ec9"
            },
            {
              "name": "https://plugins.trac.wordpress.org/changeset/2662855",
              "refsource": "CONFIRM",
              "url": "https://plugins.trac.wordpress.org/changeset/2662855"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-0328",
    "datePublished": "2022-02-28T09:06:45.000Z",
    "dateReserved": "2022-01-21T00:00:00.000Z",
    "dateUpdated": "2024-08-02T23:25:40.479Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

20 vulnerabilities found for Simple Membership by Unknown

CVE-2026-14936 (GCVE-0-2026-14936)

CVE-2026-15931 (GCVE-0-2026-15931)

CVE-2026-15930 (GCVE-0-2026-15930)

CVE-2026-11855 (GCVE-0-2026-11855)

CVE-2022-4469 (GCVE-0-2022-4469)

CVE-2022-2317 (GCVE-0-2022-2317)

CVE-2022-2273 (GCVE-0-2022-2273)

CVE-2022-1724 (GCVE-0-2022-1724)

CVE-2022-0681 (GCVE-0-2022-0681)

CVE-2022-0328 (GCVE-0-2022-0328)

CVE-2026-14936 (GCVE-0-2026-14936)

CVE-2026-15931 (GCVE-0-2026-15931)

CVE-2026-15930 (GCVE-0-2026-15930)

CVE-2026-11855 (GCVE-0-2026-11855)

CVE-2022-4469 (GCVE-0-2022-4469)

CVE-2022-2317 (GCVE-0-2022-2317)

CVE-2022-2273 (GCVE-0-2022-2273)

CVE-2022-1724 (GCVE-0-2022-1724)

CVE-2022-0681 (GCVE-0-2022-0681)

CVE-2022-0328 (GCVE-0-2022-0328)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

20 vulnerabilities found for Simple Membership by Unknown

CVE-2026-14936 (GCVE-0-2026-14936)

CVE-2026-15931 (GCVE-0-2026-15931)

CVE-2026-15930 (GCVE-0-2026-15930)

CVE-2026-11855 (GCVE-0-2026-11855)

CVE-2022-4469 (GCVE-0-2022-4469)

CVE-2022-2317 (GCVE-0-2022-2317)

CVE-2022-2273 (GCVE-0-2022-2273)

CVE-2022-1724 (GCVE-0-2022-1724)

CVE-2022-0681 (GCVE-0-2022-0681)

CVE-2022-0328 (GCVE-0-2022-0328)

CVE-2026-14936 (GCVE-0-2026-14936)

CVE-2026-15931 (GCVE-0-2026-15931)

CVE-2026-15930 (GCVE-0-2026-15930)

CVE-2026-11855 (GCVE-0-2026-11855)

CVE-2022-4469 (GCVE-0-2022-4469)

CVE-2022-2317 (GCVE-0-2022-2317)

CVE-2022-2273 (GCVE-0-2022-2273)

CVE-2022-1724 (GCVE-0-2022-1724)

CVE-2022-0681 (GCVE-0-2022-0681)

CVE-2022-0328 (GCVE-0-2022-0328)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.