What’s Vulnerable › Vulnerabilities

CVE-2023-4719: Simple Membership <= 4.3.5 - Reflected Cross-Site Scripting

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-09-06 · updated 2026-06-17
• Weakness: CWE-79

Description

The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `list_type` parameter in versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. Using this vulnerability, unauthenticated attackers could inject arbitrary web scripts into pages that are being executed if they can successfully trick a user into taking an action, such as clicking a malicious link.

Affected products

• Simple Membership: before 4.3.6 — fixed in 4.3.6

How to fix

Upgrade to a fixed version: Simple Membership 4.3.6. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2962730%40simple-membership&new=2962730%40simple-membership&sfp_email=&sfph_mail=
• https://wordpress.org/plugins/simple-membership/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e4b10172-7e54-4ff8-9fbb-41d160ce49e4?source=cve
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2962730%40simple-membership&new=2962730%40simple-membership&sfp_email=&sfph_mail=
• https://wordpress.org/plugins/simple-membership/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e4b10172-7e54-4ff8-9fbb-41d160ce49e4?source=cve

Get alerted when CVE-2023-4719 or the next vulnerability affects your stack