Medium
CVE-2026-84960
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 27
Reset filters
Medium
CVE-2026-2363
WP-Members Membership Plugin <= 3.5.5.1 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute
Medium
CVE-2025-69193
Membership <= 1.6.4 - Missing Authorization
High
CVE-2025-69292
Membership <= 1.6.4 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2025-14448
WP-Members Membership Plugin <= 3.5.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Checkbox and Multiple Select User Profile Fields
Medium
CVE-2025-12648
WP-Members Membership Plugin <= 3.5.4.4 - Unauthenticated Information Exposure via Unprotected Files
Medium
CVE-2025-57973
WP-Members <= 3.5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-9489
WP-Members Membership Plugin <= 3.5.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Names
Medium
CVE-2025-54717
WP Membership <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update
Medium
CVE-2025-7495
WP-Members <= 3.5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-50051
WP-Members <= 3.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-4610
WP-Members <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_user_memberships Shortcode
Critical
CVE-2024-10547
WP Membership <= 1.6.2 - Unauthenticated Arbitrary File Upload
Medium
CVE-2024-10374
WP-Members <= 3.4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_loginout Shortcode
Medium
CVE-2024-9231
WP-Members Membership Plugin <= 3.4.9.5 - Reflected Cross-Site Scripting
High
CVE-2024-49226
TAKETIN To WP Membership <= 2.8.12 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2024-2920
WP-Members Membership Plugin <= 3.4.9.3 - Unprotected Storage of Potentially Sensitive Files
High
CVE-2024-1852
WP-Members Membership Plugin <= 3.4.9.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2024-1987
WP-Members Membership Plugin <= 3.4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2023-6733
WP-Members Membership Plugin <= 3.4.8 - Missing Authorization to Sensitive Information Exposure
Medium
CVE-2023-2869
WP-Members Membership <= 3.4.7.3 - Cross-Site Request Forgery to Settings Update
High
CVE-2020-36666
Multiple E-plugins (Various Versions) - Authenticated (Subscriber+) Privilege Escalation
High
CVE-2019-15660
WP-Members <= 3.2.7 - Cross-Site Request Forgery
Medium
CVE-2017-2222
WP-Members < 3.1.8 - Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.