WP-Members Membership Plugin

Vulnerabilities 23Slug wp-membersLatest version 3.5.6WordPress.org →

Minimum safe version

3.5.6

Update to 3.5.6 or later to address 23 fixable vulnerabilities

Latest available3.5.6 ✓
Medium 5.5
2025-09-22< 3.5.4.3

WP-Members <= 3.5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

WordfenceEUVDCVE
N/A
2025-09-08< 3.5.4.3

WP-Members Membership Plugin <= 3.5.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Names

WordfenceCVE
N/A
2026-03-03< 3.5.6

WP-Members Membership Plugin <= 3.5.5.1 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute

WordfenceCVE
Medium 5.4
2026-01-15< 3.5.4.4

CVE-2025-14448

CVEWordfence
Medium 5.3
2026-01-07< 3.5.4.5

CVE-2025-12648

CVEWordfence
Medium 6.4
2025-07-22< 3.5.4.2

WP-Members <= 3.5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

EUVDWordfenceCVE
Medium 6.4
2025-05-17< 3.5.3

WP-Members <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_user_memberships Shortcode

EUVDWordfencePatchstackCVE
N/A
< 2.8.10

WP-Members 2.8.9 - wp-login.php register Action Multiple Parameter Reflected XSS

WPScan
N/A
< 2.8.10

WP-Members 2.8.9 - profile.php Multiple Parameter Stored XSS

WPScan
N/A
2014-01-07< 2.8.10

WP-Members Membership Plugin <= 2.8.9 - Reflected Cross-Site Scripting

Wordfence
N/A
2014-08-01< 2.8.10

WordPress Members Plugin <= 2.8.9 - Reflected XSS

Patchstack
N/A
2014-08-01< 2.8.10

WordPress Members Plugin <= 2.8.9 - Stored XSS

Patchstack
N/A
2019-06-16< 3.2.8.1

WordPress WP-Members plugin <= 3.2.7 - Cross-Site Request Forgery (CSRF) vulnerability

Patchstack