CVE-2022-1724: Simple Membership < 4.1.1 - Reflected Cross-Site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-06-13 · updated 2026-06-17
Weakness: CWE-79

Description

The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting

Affected products

Simple Membership: before 4.1.1 — fixed in 4.1.1

How to fix

Upgrade to a fixed version: Simple Membership 4.1.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/96a0a667-9c4b-4ea6-b78a-0681e9a9bbae
https://wpscan.com/vulnerability/96a0a667-9c4b-4ea6-b78a-0681e9a9bbae

Get alerted when CVE-2022-1724 or the next vulnerability affects your stack