Vulnerabilities

TI-2026-67647 CVE-2026-104401 · GHSA-vjwf-8fv5-9q2x

Sensitive data exposure in Memberful Membership Plugin for WordPress

LOW 19

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Retrieve Embedded Sensitive Data.This issue affects Memberful - Memb…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00215 Published 2026-10-05 No fix listed CWE-497

TI-2026-65580 CVE-2026-103067 · GHSA-9cvx-6vvx-mm83

WordPress Memberful - Membership Plugin plugin <= 1.81.0 - Cross Site Request Forgery (CSRF) vulnerability

LOW 36

Cross-Site Request Forgery (CSRF) vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Cross Site Request Forgery.This issue affects Memberful - Membership Plugin: from n/a through 1.81.0.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00124 Published 2026-10-01 No fix listed CWE-352

TI-2025-35852 CVE-2025-58000 · GHSA-86fc-c64w-3q6q

WordPress Memberful plugin <= 1.75.0 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in memberful Memberful - Membership Plugin memberful-wp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Memberful - Membership Plugin: from n/a throu…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00265 Published 2025-09-22 No fix listed CWE-862

TI-2024-10463 CVE-2024-11294 · GHSA-jqgc-ch7p-x5g4

Memberful <= 1.73.9 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure

LOW 31

The Memberful plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.73.9 via the WordPress core search feature.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00473 Published 2024-12-17 No fix listed CWE-200

TI-2024-08578 CVE-2024-9242 · GHSA-29hv-5386-jfwg

Memberful – Membership Plugin <= 1.73.7 - Authenticated (contributor+) Stored Cross-Site Scripting

LOW 28

The Memberful – Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'memberful_buy_subscription_link' and 'memberful_podcasts_link' shortcodes in all versions up to, and i…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00321 Published 2024-10-04 No fix listed CWE-79