CVE-2022-1724: vulnerability in Simple Membership
Simple Membership < 4.1.1 - Reflected Cross-Site Scripting
Published · Updated
18Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 1.8%
exploitation probability
1.8%top 22% of all CVEs
observed exploitation
nono source reports it
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting
Affected products
Unknown · Simple MembershipRelated CVEs — Simple Membership
In the same product, most dangerous first.
CVE-2022-2317—Simple Membership < 4.1.3 - Unauthenticated Membership Privilege EscalationEPSS 1.4%CVE-2022-2273—Simple Membership < 4.1.3 - Membership Privilege EscalationEPSS 1.2%CVE-2022-4469MEDIUMSimple Membership < 4.2.2 - Contributor+ Stored XSSEPSS 0.5%CVE-2022-0681—Simple Membership < 4.1.0 - Arbitrary Transaction Deletion via CSRFEPSS 0.5%CVE-2026-11855HIGHSimple Membership < 4.7.5 - Unauthenticated Stored XSS via Stripe Webhook API VersionEPSS 0.5%CVE-2022-0328—Simple Membership < 4.0.9 - Arbitrary Member Deletion via CSRFEPSS 0.5%