Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Simple Membership 4.7.8 Clear all filters
TI-2026-13345 CVE-2026-15931 · GHSA-cc2x-fmqx-2g5v

Simple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name

Priority MEDIUM 60

The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, a…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00275 Published 2026-08-03 Fixed in 4.7.8 CWE-79
TI-2026-13344 CVE-2026-15930 · GHSA-7g75-5pmj-3v8p

Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision

Priority MEDIUM 47

The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers t…

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00418 Published 2026-08-03 Fixed in 4.7.8 CWE-862