WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
memberdash
Published
2026-09-05
Title
MemberDash < 1.8.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter
Slug
memberfindme
Published
2025-11-11
Title
MembershipWorks < 6.15 - Authenticated (Admin+) Stored Cross-Site Scripting
Slug
memberfindme
Published
2026-10-27
Title
MembershipWorks < 6.17 - Unauthenticated Payment Bypass
Slug
memberful-wp
Published
2024-10-03
Title
Memberful – Membership Plugin < 1.73.8 - Authenticated (contributor+) Stored Cross-Site Scripting
Slug
memberful-wp
Published
2024-12-16
Title
Memberful < 1.74.0 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
Slug
memberful-wp
Published
2025-09-22
Title
Memberful < 1.76.0 - Missing Authorization
Slug
memberful-wp
Published
2026-10-01
Title
Memberful – Membership Plugin < 1.81.1 - Cross-Site Request Forgery
Slug
memberful-wp
Published
2026-10-05
Title
Memberful – Membership Plugin < 1.82.0 - Authenticated (Contributor+) Protected Post Content Disclosure
Slug
memberglut
Published
2026-07-06
Title
MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation to Administrator
Slug
memberlite-shortcodes
Published
2023-10-09
Title
Memberlite Shortcodes < 1.3.9 - Contributor+ Stored XSS via Shortcode
Slug
memberlite-shortcodes
Published
2024-11-22
Title
Memberlite Shortcodes < 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via memberlite_accordion Shortcode
Slug
memberlite-shortcodes
Published
2025-09-16
Title
Memberlite Shortcodes < 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
memberlite-shortcodes
Published
2025-10-17
Title
Memberlite Shortcodes <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
membermouse
Published
2018-05-27
Title
Membermouse < 2.2.9 - Blind SQL Injection
Slug
memberpress
Published
2024-03-21
Title
Memberpress < 1.11.27 - Reflected Cross-Site Scripting via message and error
Slug
memberpress
Published
2024-05-21
Title
MemberPress < 1.11.30 - Authenticated (Contributor+) Blind Server-Side Request Forgery via mepr-user-file Shortcode
Slug
memberpress
Published
2024-05-21
Title
MemberPress < 1.11.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via arglist Parameter
Slug
memberpress
Published
2024-08-29
Title
MemberPress < 1.11.30 - Reflected Cross-Site Scripting via mepr_screenname and mepr_key Parameters
Slug
memberpress
Published
2024-08-26
Title
Memberpress < 1.11.35 - Missing Authorization
Slug
memberpress
Published
2025-04-17
Title
Memberpress < 1.12.0 - Reflected Cross-Site Scripting
Slug
memberpress
Published
2025-04-21
Title
Memberpress < 1.12.0 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
Slug
memberpress
Published
2026-10-27
Title
Memberpress < 1.14.2 - Cross-Site Request Forgery via 'user_email' Parameter
Slug
memberpress-corporate
Published
2026-09-11
Title
MemberPress Corporate Accounts < 1.6.0 - Authenticated (Subscriber+) Privilege Escalation via Mass Assignment in Sub-Account Creation
Slug
memberpress-downloads
Published
2022-09-19
Title
Memberpress Downloads < 1.2.6 - Subscriber+ Arbitrary File Upload
Slug
members
Published
2024-12-10
Title
Members < 3.2.11 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure