CVE-2026-88785

The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN acce...

Cross site scripting

The Membership WordPress plugin before 3.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-3182

CVE-2023-3182 affects the Membership Plugin – Restrict Content for WordPress, prior to version 3.2.3. The root cause is improper sanitisation/escaping of a parameter before it is echoed back on the page, enabling a reflected XSS against high-privilege users (e.g., admins). Public sources in conne...

PT-2023-23473 · WordPress · Membership

Name of the Vulnerable Software and Affected Versions: Membership WordPress plugin versions prior to 3.2.3 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. Th...