What’s Vulnerable › Products
cbutlerjr WP-Members Membership Plugin vulnerabilities
18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.
Check whether your cbutlerjr WP-Members Membership Plugin version is affected
Latest cbutlerjr WP-Members Membership Plugin vulnerabilities
- CVE-2026-84960 — WP-Members Membership Plugin <= 3.5.6 - Reflected Cross-Site Scripting (CVSS 6.1)
- CVE-2026-2363 — WP-Members Membership Plugin <= 3.5.5.1 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute (CVSS 6.5)
- CVE-2025-14448 — WP-Members Membership Plugin <= 3.5.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Checkbox and Multiple Select User Profile Fields (CVSS 5.4)
- CVE-2025-12648 — WP-Members Membership Plugin <= 3.5.4.4 - Unauthenticated Information Exposure via Unprotected Files (CVSS 5.3)
- CVE-2025-57973 — WordPress WP-Members Plugin <= 3.5.4.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.5)
- CVE-2025-9489 — WP-Members Membership Plugin <= 3.5.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Names (CVSS 5.0)
- CVE-2025-7495 — WP-Members <= 3.5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- CVE-2025-50051 — WordPress WP-Members plugin <= 3.5.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- CVE-2025-4610 — WP-Members <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_user_memberships Shortcode (CVSS 6.4)
- CVE-2024-10374 — WP-Members <= 3.4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_loginout Shortcode (CVSS 5.4)
- CVE-2024-9231 — WP-Members Membership Plugin <= 3.4.9.5 - Reflected Cross-Site Scripting (CVSS 6.1)
- CVE-2024-2920 — WP-Members Membership Plugin <= 3.4.9.3 - Unprotected Storage of Potentially Sensitive Files (CVSS 5.3)
- CVE-2024-1852 — WP-Members Membership Plugin <= 3.4.9.2 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.1)
- CVE-2024-1987 — WP-Members Membership Plugin <= 3.4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 5.4)
- CVE-2023-6733 — WP-Members Membership Plugin <= 3.4.8 - Missing Authorization to Sensitive Information Exposure (CVSS 6.5)
- CVE-2023-2869 — WP-Members Membership <= 3.4.7.3 - Missing Authorization to Settings Update (CVSS 4.3)
- CVE-2019-15660 — (CVSS 8.8)
- CVE-2017-2222 — (CVSS 6.1)