Membership Database <= 1.0 - Cross-Site Scripting

Membership Database before 1.0 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker t...

ARMember < 3.4.8 - Unauthenticated Admin Account Takeover

The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover even the administrator due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username. id:...

WCFM Membership <= 2.10.0 - Broken Access Control

The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks true the AJAX actions: wcfm-memberships, wcfm-memberships-manage, and wcfm-memberships-settings. id: CVE-2022-4940 info:...

WordPress Simple Membership <4.1.1 - Cross-Site Scripting

WordPress Simple Membership plugin before 4.1.1 contains a reflected cross-site scripting vulnerability. It does not properly sanitize and escape parameters before outputting them back in AJAX actions. id: CVE-2022-1724 info: name: WordPress Simple Membership 4.1.1 - Cross-Site Scripting author:...

User Registration & Membership WordPress plugin - Open Redirect

User Registration & Membership WordPress plugin = 5.1.4 contains an open redirect caused by insufficient validation of 'redirecttoonlogout' parameter, letting attackers redirect users to malicious external URLs after logout, exploit requires crafted URL. id: CVE-2026-6203 info: name: User...

CVE-2026-74001

Unauthenticated Broken Authentication in User Registration & Membership Pro = 5.4.5 versions...

CVE-2026-74001

User Registration & Membership Pro is a WordPress plugin affected by an unauthenticated broken authentication vulnerability in versions ≤ 5.4.5 , enabling account takeover without any prior credentials. The flaw was discovered by 0xd4rk5id3 and carries a CVSS 3.1 score of 9.8 (CRITICAL) with a ne...

EUVD-2026-63314

Unauthenticated Broken Authentication in User Registration & Membership Pro = 5.4.5 versions...

CVE-2026-74001 WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability

Unauthenticated Broken Authentication in User Registration & Membership Pro = 5.4.5 versions...

OESA-2026-3423 postgresql-17 security update

PostgreSQL client programs Security Fixes: Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the...

WordPress Ultimate Member 2.1.3 - 2.8.2 – SQL Injection

The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘sorting’ parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-18756

HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow. An attacker can place attacker-controlled button configuration in the options query-string parameter of space/membership/request-membership-form, lure an authenticated...

CVE-2026-18756 HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering

HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow. An attacker can place attacker-controlled button configuration in the options query-string parameter of space/membership/request-membership-form, lure an authenticated...

CVE-2026-18756 HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering

HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow. An attacker can place attacker-controlled button configuration in the options query-string parameter of space/membership/request-membership-form, lure an authenticated...

EUVD-2026-62500

HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow. An attacker can place attacker-controlled button configuration in the options query-string parameter of space/membership/request-membership-form, lure an authenticated...

CVE-2026-18756

HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow . An attacker can inject attacker-controlled button configuration via the options query-string parameter of space/membership/request-membership-form, then lure an authe...

CVE-2026-32552

Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...

CVE-2026-32552 WordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injection vulnerability

Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...

EUVD-2026-62372

Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...

CVE-2026-32552

A SQL Injection vulnerability exists in the YITH WooCommerce Membership Premium WordPress plugin, affecting versions 2.33.0 and earlier . The flaw is in the Subscriber functionality and was discovered by dutafi . The CVSS 3.1 score is 8.5 (HIGH) , with a network attack vector, low complexity, and...