Plugin icon

WP-Members Membership Plugin

wp-members

Vulnerabilities:

19

Last Updated:

February 27, 2026

Active Installs:

50000

Published
Title
Fixed in
CVSS
Published
2026-03-03
Title
WP-Members Membership Plugin < 3.5.6 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute
Fixed in
Fixed in 3.5.6
CVSS
4.9 (medium)
Published
2026-01-14
Title
WP-Members Membership Plugin < 3.5.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Checkbox and Multiple Select User Profile Fields
Fixed in
Fixed in 3.5.4.4
CVSS
5.4 (medium)
Published
2026-01-06
Title
WP-Members Membership Plugin < 3.5.4.5 - Unauthenticated Information Exposure via Unprotected Files
Fixed in
Fixed in 3.5.4.5
CVSS
5.3 (medium)
Published
2025-09-22
Title
WP-Members < 3.5.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.5.4.3
CVSS
6.4 (medium)
Published
2025-09-08
Title
WP-Members Membership Plugin < 3.5.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Names
Fixed in
Fixed in 3.5.4.3
CVSS
5 (medium)
Published
2025-07-21
Title
WP-Members < 3.5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.5.4.2
CVSS
6.4 (medium)
Published
2025-06-19
Title
WP-Members < 3.5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.5.4.1
CVSS
6.4 (medium)
Published
2025-05-16
Title
WP-Members < 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_user_memberships Shortcode
Fixed in
Fixed in 3.5.3
CVSS
6.4 (medium)
Published
2024-10-24
Title
WP-Members < 3.4.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_loginout Shortcode
Fixed in
Fixed in 3.4.9.6
CVSS
6.4 (medium)
Published
2024-10-21
Title
WP-Members Membership Plugin < 3.4.9.6 - Reflected Cross-Site Scripting
Fixed in
Fixed in 3.4.9.6
CVSS
6.1 (medium)
Published
2024-04-25
Title
WP-Members Membership Plugin < 3.4.9.4 - Unprotected Storage of Potentially Sensitive Files
Fixed in
Fixed in 3.4.9.4
CVSS
5.3 (medium)
Published
2024-04-01
Title
WP-Members Membership Plugin < 3.4.9.3 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 3.4.9.3
CVSS
7.2 (high)
Published
2024-03-07
Title
WP-Members Membership Plugin < 3.4.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Fixed in
Fixed in 3.4.9.2
CVSS
6.4 (medium)
Published
2024-01-03
Title
WP-Members Membership Plugin < 3.4.9 - Contributor+ Sensitive Information Exposure
Fixed in
Fixed in 3.4.9
CVSS
4.9 (medium)
Published
2023-06-08
Title
WP-Members Membership < 3.4.8 - Subscriber+ Unauthorized Plugin Settings Update
Fixed in
Fixed in 3.4.8
CVSS
4.3 (medium)
Published
2019-06-13
Title
WP-Members < 3.2.8.1 - Cross-Site Request Forgery (CSRF)
Fixed in
Fixed in 3.2.8.1
CVSS
8.8 (high)
Published
2017-07-13
Title
WP-Members <= 3.1.7 - Authenticated Cross-Site Scripting (XSS)
Fixed in
Fixed in 3.1.8
CVSS
6.1 (medium)
Published
2014-08-01
Title
WP-Members 2.8.9 - wp-login.php register Action Multiple Parameter Reflected XSS
Fixed in
Fixed in 2.8.10
CVSS
n/a
Published
2014-08-01
Title
WP-Members 2.8.9 - profile.php Multiple Parameter Stored XSS
Fixed in
Fixed in 2.8.10
CVSS
n/a