PLUGIN SECURITY
Is Simple Membership safe?
Simple membership plugin adds membership functionality to your site. Protect members only content using content protection easily.
What this plugin does
- Slug:
simple-membership - Author: wp.insider
- 40000+ active installs
- 92/100 rating (475 reviews on wordpress.org)
- 3500103 all-time downloads
- On WordPress.org since 2014-05-30
membermembersmembers-onlymembershipmemberships
Maintenance status
- Latest known version: 4.7.9
- Last updated: 2026-08-31 4:40am GMT
- Tested up to WordPress: 7.1
- Requires PHP: 7.4+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
33 known CVEs on file for Simple Membership.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-14936 | Simple Membership [simple-membership] < 4.7.7 | Insufficient Verification of Data Authenticity | Medium 5.3 | < 4.7.7 | 4.7.7 | 2026-08-06 | ✓ fixed in latest |
| CVE-2026-66712 | Simple Membership [simple-membership] < 4.7.9 | Missing Authorization | High 7.5 | < 4.7.9 | 4.7.9 | 2026-08-05 | ✓ fixed in latest |
| CVE-2026-15931 | Simple Membership [simple-membership] < 4.7.8 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 4.7.8 | 4.7.8 | 2026-07-24 | ✓ fixed in latest |
| CVE-2026-15930 | Simple Membership [simple-membership] < 4.7.8 | Missing Authorization | Unknown | < 4.7.8 | 4.7.8 | 2026-07-24 | ✓ fixed in latest |
| CVE-2026-11855 | Simple Membership [simple-membership] < 4.7.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 4.7.5 | 4.7.5 | 2026-07-06 | ✓ fixed in latest |
| CVE-2026-12093 | Simple Membership [simple-membership] < 4.7.6 | Missing Authorization | Medium 5.3 | < 4.7.6 | 4.7.6 | 2026-06-17 | ✓ fixed in latest |
| CVE-2026-42663 | Simple Membership [simple-membership] < 4.7.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 4.7.3 | 4.7.3 | 2026-05-03 | ✓ fixed in latest |
| CVE-2026-34886 | Simple Membership [simple-membership] < 4.7.2 | Missing Authorization | High 7.5 | < 4.7.2 | 4.7.2 | 2026-03-31 | ✓ fixed in latest |
+ 31 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-25308 | Simple Membership [simple-membership] < 4.7.0 | Missing Authorization | Medium 4.3 | < 4.7.0 | 4.7.0 | 2026-01-19 | ✓ fixed in latest |
| CVE-2025-49333 | Simple Membership [simple-membership] < 4.6.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.9 | < 4.6.4 | 4.6.4 | 2025-06-05 | ✓ fixed in latest |
| CVE-2024-11088 | Simple Membership [simple-membership] < 4.5.6 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 4.5.6 | 4.5.6 | 2024-11-20 | ✓ fixed in latest |
| CVE-2024-49682 | Simple Membership [simple-membership] < 4.5.4 | URL Redirection to Untrusted Site ('Open Redirect') | Medium 4.7 | < 4.5.4 | 4.5.4 | 2024-10-21 | ✓ fixed in latest |
| CVE-2024-4383 | Simple Membership [simple-membership] < 4.4.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 4.4.6 | 4.4.6 | 2024-05-03 | ✓ fixed in latest |
| CVE-2024-3730 | Simple Membership [simple-membership] < 4.4.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 4.4.4 | 4.4.4 | 2024-04-24 | ✓ fixed in latest |
| CVE-2024-1985 | Simple Membership [simple-membership] < 4.4.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 4.4.3 | 4.4.3 | 2024-03-05 | ✓ fixed in latest |
| CVE-2024-22308 | Simple Membership [simple-membership] < 4.4.2 | URL Redirection to Untrusted Site ('Open Redirect') | Low 3.4 | < 4.4.2 | 4.4.2 | 2024-01-19 | ✓ fixed in latest |
| CVE-2023-50376 | Simple Membership [simple-membership] < 4.3.9 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 4.3.9 | 4.3.9 | 2023-12-19 | ✓ fixed in latest |
| CVE-2023-6882 | Simple Membership [simple-membership] < 4.3.9 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 4.3.9 | 4.3.9 | 2023-12-18 | ✓ fixed in latest |
| CVE-2023-41956 | Simple Membership [simple-membership] < 4.3.5 | Improper Authentication | High 8.8 | < 4.3.5 | 4.3.5 | 2023-09-25 | ✓ fixed in latest |
| CVE-2023-41957 | Simple Membership [simple-membership] < 4.3.5 | Improper Privilege Management | High 8.6 | < 4.3.5 | 4.3.5 | 2023-09-25 | ✓ fixed in latest |
| CVE-2023-4719 | Simple Membership [simple-membership] < 4.3.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 4.3.6 | 4.3.6 | 2023-09-05 | ✓ fixed in latest |
| CVE-2022-4469 | Simple Membership [simple-membership] < 4.2.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 4.2.2 | 4.2.2 | 2022-12-21 | ✓ fixed in latest |
| CVE-2022-2273 | Simple Membership [simple-membership] < 4.1.3 | Improper Privilege Management | High 8.8 | < 4.1.3 | 4.1.3 | 2022-07-06 | ✓ fixed in latest |
| CVE-2022-2317 | Simple Membership [simple-membership] < 4.1.3 | Improper Privilege Management | Critical 9.8 | < 4.1.3 | 4.1.3 | 2022-07-06 | ✓ fixed in latest |
| CVE-2022-1724 | Simple Membership [simple-membership] < 4.1.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 4.1.1 | 4.1.1 | 2022-05-23 | ✓ fixed in latest |
| CVE-2022-0681 | Simple Membership [simple-membership] < 4.1.0 | Cross-Site Request Forgery (CSRF) | Medium 6.5 | < 4.1.0 | 4.1.0 | 2022-02-25 | ✓ fixed in latest |
| CVE-2022-0328 | Simple Membership [simple-membership] < 4.0.9 | Cross-Site Request Forgery (CSRF) | Medium 4.7 | < 4.0.9 | 4.0.9 | 2022-01-25 | ✓ fixed in latest |
| — | Simple Membership [simple-membership] < 4.0.4 | — | Unknown | < 4.0.4 | 4.0.4 | 2021-04-05 | ✓ fixed in latest |
| CVE-2019-14328 | Simple Membership [simple-membership] < 3.8.5 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 3.8.5 | 3.8.5 | 2019-07-27 | ✓ fixed in latest |
| CVE-2017-18499 | Simple Membership [simple-membership] < 3.5.7 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 3.5.7 | 3.5.7 | 2017-11-08 | ✓ fixed in latest |
| CVE-2016-10884 | Simple Membership [simple-membership] < 3.3.3 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 3.3.3 | 3.3.3 | 2016-09-16 | ✓ fixed in latest |
| — | Simple Membership [simple-membership] < 3.2.9 | — | Unknown | < 3.2.9 | 3.2.9 | 2016-07-14 | ✓ fixed in latest |
| — | Simple Membership [simple-membership] < 3.2.9 | — | Unknown | < 3.2.9 | 3.2.9 | 2016-07-14 | ✓ fixed in latest |
| CVE-2021-29232 | Simple Membership [simple-membership] < 4.0.4 | — | Unknown | < 4.0.4 | 4.0.4 | 0000-00-00 | ✓ fixed in latest |
| — | Simple Membership [simple-membership] < 4.7.1 | — | Unknown | < 4.7.1 | 4.7.1 | 0000-00-00 | ✓ fixed in latest |
| CVE-2026-77194 | Simple Membership [simple-membership] < 4.8.2 | — | Unknown | < 4.8.2 | 4.8.2 | 0000-00-00 | ⚠ update needed |
| — | Simple Membership [simple-membership] < 3.2.9 | — | Unknown | < 3.2.9 | 3.2.9 | — | ✓ fixed in latest |
| — | Simple Membership <= 3.2.8 - Cross-Site Scripting (XSS) | — | Unknown | < 3.2.9 | 3.2.9 | — | ✓ fixed in latest |
| CVE-2026-1461 | Simple Membership < 4.7.1 - Unauthenticated Improper Handling of Missing Values | — | Unknown | < 4.7.1 | 4.7.1 | — | ✓ fixed in latest |
How to fix it
Keep Simple Membership updated — 4.7.9 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin — 200000+ active installs — 88/100 (1444) — max PHP 8.4
- BuddyPress — 90000+ active installs — 82/100 (375) — max PHP <8.0
- Ultimate Member – reCAPTCHA — 20000+ active installs — 74/100 (11) — max PHP 8.4
- Simple Membership After Login Redirection — 10000+ active installs — 96/100 (15)
- Groups – Memberships and Access Control — 10000+ active installs — 96/100 (382)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.