# Simple Membership

> Simple membership plugin adds membership functionality to your site. Protect members only content using content protection easily.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 10:31 UTC.

## Facts (WordPress.org)

- Slug: `simple-membership`
- Author: wp.insider
- Version: 4.8.8
- Active installs: 40,000+
- Last update: 2026-11-10 (3 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.0, PHP 7.4
- Tags: member, members, members-only, membership, memberships
- Page: https://wordpress.org/plugins/simple-membership/

## Checks (against WordPress 7.1.4)

- OK: Updated 3 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Locked in ↔ Portable, Slow ↔ Responsive, Steep ↔ Easy, Vague docs ↔ Clear docs, Behind ↔ Current, Heavy ↔ Light.

## Known vulnerabilities

- 2026-10-11 LOW: Information Exposure (up to 4.8.2). CVE-2026-88785, https://www.wordfence.com/threat-intel/vulnerabilities/id/c77d0ab6-12d5-4aed-a507-82a718c68301?source=api-prod
- 2026-10-10 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field (up to 4.8.4). CVE-2026-103427, https://www.wordfence.com/threat-intel/vulnerabilities/id/fbebb9d4-c445-473d-a5f6-beac00ebe7aa?source=api-prod
- 2026-10-03 HIGH: Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints (up to 4.8.3). CVE-2026-97337, https://www.wordfence.com/threat-intel/vulnerabilities/id/ae2b6c4c-7dd6-41e7-8b8d-c09aa7fa660b?source=api-prod
- 2026-09-17 MEDIUM: Missing Authorization (up to 4.8.2). CVE-2026-74000, https://www.wordfence.com/threat-intel/vulnerabilities/id/8af4f5b3-498a-4543-ad08-2140f6d51562?source=api-prod
- 2026-09-13 MEDIUM: Missing Authorization (before 4.7.8). CVE-2026-88764, https://www.wordfence.com/threat-intel/vulnerabilities/id/1bfb0bab-20d0-4172-b912-7f209cad4c3b?source=api-prod
- 2026-09-01 MEDIUM: Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding (up to 4.8.1). CVE-2026-77194, https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd3eae5-3d30-4d0d-8f95-5f0747e4e944?source=api-prod
- 2026-08-06 MEDIUM: Missing Authorization (up to 4.7.8). CVE-2026-66712, https://www.wordfence.com/threat-intel/vulnerabilities/id/e76c921f-a950-401f-ac37-c28efc0f3064?source=api-prod
- 2026-08-06 MEDIUM: Unauthenticated Payment Verification Bypass (up to 4.7.6). CVE-2026-14936, https://www.wordfence.com/threat-intel/vulnerabilities/id/79abf52c-c653-4346-94cd-4b56564e6b99?source=api-prod
- 2026-08-03 MEDIUM: Missing Authorization (up to 4.7.7). CVE-2026-15930, https://www.wordfence.com/threat-intel/vulnerabilities/id/ac7d08e6-b04d-4b8c-af43-1abe8b531f7c?source=api-prod
- 2026-08-03 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 4.7.7). CVE-2026-15931, https://www.wordfence.com/threat-intel/vulnerabilities/id/ce4872f8-f589-4ae9-a5c5-4bb66043bfeb?source=api-prod
- 2026-07-06 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 4.7.4). CVE-2026-11855, https://www.wordfence.com/threat-intel/vulnerabilities/id/c7fe81f4-a3f3-4e4e-ae30-f4d09844461c?source=api-prod
- 2026-06-18 MEDIUM: Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook (up to 4.7.5). CVE-2026-12093, https://www.wordfence.com/threat-intel/vulnerabilities/id/2f91a7c3-ee0e-48e9-aa5f-dfc1160bbc09?source=api-prod
- 2026-06-15 MEDIUM: Missing Authorization (up to 4.7.1). CVE-2026-34886, https://www.wordfence.com/threat-intel/vulnerabilities/id/bd9336ba-0a91-4fe5-b564-1adf739f4193?source=api-prod
- 2026-06-15 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 4.7.2). CVE-2026-42663, https://www.wordfence.com/threat-intel/vulnerabilities/id/25e145b5-719b-4b7c-aee2-343e8418bf08?source=api-prod
- 2026-02-18 MEDIUM: Unauthenticated Improper Handling of Missing Values (up to 4.7.0). CVE-2026-1461, https://www.wordfence.com/threat-intel/vulnerabilities/id/4e4df9a6-8f7d-428b-a596-0751ca047169?source=api-prod
- 2026-01-19 MEDIUM: Missing Authorization (up to 4.6.9). CVE-2026-25308, https://www.wordfence.com/threat-intel/vulnerabilities/id/6b7ce040-32b7-4440-be4f-d33fe9c49e51?source=api-prod
- 2025-06-05 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 4.6.3). CVE-2025-49333, https://www.wordfence.com/threat-intel/vulnerabilities/id/45bb4a6f-560f-4dc8-9005-1e4c5727d56f?source=api-prod
- 2024-11-20 MEDIUM: Exposure of Private Personal Information to an Unauthorized Actor (up to 4.5.5). CVE-2024-11088, https://www.wordfence.com/threat-intel/vulnerabilities/id/c1558b08-a33b-4cf2-bacb-c88065f513cc?source=api-prod
- 2024-10-21 MEDIUM: Unauthenticated Open Redirect (up to 4.5.3). CVE-2024-49682, https://www.wordfence.com/threat-intel/vulnerabilities/id/b4b7adcf-c58b-4019-89ff-a69ebf8262bc?source=api-prod
- 2024-05-03 MEDIUM: Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (up to 4.4.5). CVE-2024-4383, https://www.wordfence.com/threat-intel/vulnerabilities/id/56fdbf80-8ea2-412a-b166-b7c27de88e70?source=api-prod
- 2024-04-24 MEDIUM: Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (up to 4.4.3). CVE-2024-3730, https://www.wordfence.com/threat-intel/vulnerabilities/id/63779ab7-ba8b-459d-beb3-a32faf8f4394?source=api-prod
- 2024-03-05 MEDIUM: Unauthenticated Stored Self-Based Cross-Site Scripting (up to 4.4.2). CVE-2024-1985, https://www.wordfence.com/threat-intel/vulnerabilities/id/8a6ca886-de4c-4d45-a934-3e90378e7eb3?source=api-prod
- 2024-01-19 MEDIUM: Open Redirect (up to 4.4.1). CVE-2024-22308, https://www.wordfence.com/threat-intel/vulnerabilities/id/b0086de8-448f-452f-89d1-84b77b2e25a8?source=api-prod
- 2023-12-19 MEDIUM: Reflected Cross-Site Scripting (before 4.3.9). CVE-2023-50376, https://www.wordfence.com/threat-intel/vulnerabilities/id/18fe9769-3681-4a5e-866a-640b4cc76199?source=api-prod
- 2023-12-18 MEDIUM: Reflected Cross-Site Scripting Vulnerability via environment_mode (up to 4.3.8). CVE-2023-6882, https://www.wordfence.com/threat-intel/vulnerabilities/id/366165fe-93e5-49ab-b2e5-1de624f22286?source=api-prod
- 2023-09-25 HIGH: Privilege escalation via Registration (up to 4.3.4). CVE-2023-41957, https://www.wordfence.com/threat-intel/vulnerabilities/id/7cff7dc5-23e1-424c-923b-68eef49dec6f?source=api-prod
- 2023-09-25 HIGH: Account Takeover via Password Reset (up to 4.3.4). CVE-2023-41956, https://www.wordfence.com/threat-intel/vulnerabilities/id/e53bb240-8784-4d34-8d3f-4a7af917f3f4?source=api-prod
- 2023-09-05 HIGH: Reflected Cross-Site Scripting (up to 4.3.5). CVE-2023-4719, https://www.wordfence.com/threat-intel/vulnerabilities/id/e4b10172-7e54-4ff8-9fbb-41d160ce49e4?source=api-prod
- 2022-12-21 MEDIUM: Authenticated (Contributor+) Cross Site Scripting via shortcode (up to 4.2.1). CVE-2022-4469, https://www.wordfence.com/threat-intel/vulnerabilities/id/7772c78e-3134-4855-ac4e-3520c584c2e7?source=api-prod
- 2022-07-06 CRITICAL:  Membership Privilege Escalation (up to 4.1.2). CVE-2022-2317, https://www.wordfence.com/threat-intel/vulnerabilities/id/284eafb9-94bc-4478-abff-f7dafd510a1d?source=api-prod
- 2022-07-06 HIGH: Membership Privilege Escalation (up to 4.1.2). CVE-2022-2273, https://www.wordfence.com/threat-intel/vulnerabilities/id/792282d1-5f43-4511-becc-9c5bb5ae513a?source=api-prod
- 2022-05-23 MEDIUM: Reflected Cross-Site Scripting (up to 4.1.0). CVE-2022-1724, https://www.wordfence.com/threat-intel/vulnerabilities/id/dc322548-ffc9-4246-9835-fcc5705cef3f?source=api-prod
- 2022-02-25 MEDIUM: Cross-Site Request Forgery to Arbitrary Transaction Deletion (before 4.1.0). CVE-2022-0681, https://www.wordfence.com/threat-intel/vulnerabilities/id/7aa6da4d-7221-4878-8532-5372227f906a?source=api-prod
- 2022-01-25 HIGH: Cross-Site Request Forgery to Arbitrary Member Deletion (before 4.0.9). CVE-2022-0328, https://www.wordfence.com/threat-intel/vulnerabilities/id/70fa060f-11eb-4b51-b985-59421f44414e?source=api-prod
- 2021-04-05 HIGH: Authenticated (Admin+) SQL Injections (up to 4.0.3). WF-1664fef3-6416-4678-9ee7-bed2184d7490, https://www.wordfence.com/threat-intel/vulnerabilities/id/1664fef3-6416-4678-9ee7-bed2184d7490?source=api-prod
- 2019-07-27 HIGH: Cross-Site Request Forgery (before 3.8.5). CVE-2019-14328, https://www.wordfence.com/threat-intel/vulnerabilities/id/839957ea-5186-4cce-971d-57eed84639d5?source=api-prod
- 2017-11-08 MEDIUM: Cross-Site Scripting (before 3.5.7). CVE-2017-18499, https://www.wordfence.com/threat-intel/vulnerabilities/id/cfd3f0e3-e73e-4ec2-ac67-da1cc15aa217?source=api-prod
- 2016-09-16 HIGH: Multiple Cross-Site Request Forgery (up to 3.3.2). CVE-2016-10884, https://www.wordfence.com/threat-intel/vulnerabilities/id/6f721aa1-d12f-4829-8e82-61f9af6a3519?source=api-prod
- 2016-07-14 MEDIUM: Reflected Cross-Site Scripting (before 3.2.9). WF-95c2038f-c4f9-472a-92ab-59ee395bda3d, https://www.wordfence.com/threat-intel/vulnerabilities/id/95c2038f-c4f9-472a-92ab-59ee395bda3d?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=simple-membership · HTML: https://todaywp.com/plugins/simple-membership