Advisories · Technology
Simple Membership.
Every CVE that names Simple Membership among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.7 Medium
Simple Membership < 4.8.3 - Newly Registered Member Password Disclosure via URL Query String
- Simple Membership
- Information disclosure
- CVSS 5.4 Medium
Simple Membership < 4.7.8 - Subscriber+ Membership Level Escalation via PayPal Standard subsc_ref
- Simple Membership
- Privilege escalation
- CVSS 5.3 Medium
Simple Membership < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification
- Simple Membership
- CWE-345
- CVSS 6.1 Medium
Simple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name
- Simple Membership
- Cross-site scripting (XSS)
- CVSS 9.4 CriticalCritical · CVSS 9+
Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision
- Simple Membership
- Broken access control
- CVSS 8.8 High
Simple Membership < 4.7.5 - Unauthenticated Stored XSS via Stripe Webhook API Version
- Simple Membership
- CVSS 5.4 Medium
Simple Membership < 4.2.2 - Contributor+ Stored XSS
- Simple Membership
-
Simple Membership < 4.1.3 - Unauthenticated Membership Privilege Escalation
- Simple Membership
- Privilege escalation
-
Simple Membership < 4.1.3 - Membership Privilege Escalation
- Simple Membership
- Privilege escalation
-
Simple Membership < 4.1.1 - Reflected Cross-Site Scripting
- Simple Membership
- Cross-site scripting (XSS)
-
Simple Membership < 4.1.0 - Arbitrary Transaction Deletion via CSRF
- Simple Membership
- Cross-site request forgery (CSRF)
-
Simple Membership < 4.0.9 - Arbitrary Member Deletion via CSRF
- Simple Membership
- Cross-site request forgery (CSRF)