CVE-2022-4469: medium-severity vulnerability in Simple Membership
Simple Membership < 4.2.2 - Contributor+ Stored XSS
Published · Updated
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.4epss 0.5%
exploitation probability
0.5%top 57% of all CVEs
observed exploitation
nono source reports it
The Simple Membership WordPress plugin before 4.2.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
Unknown · Simple MembershipRelated CVEs — Simple Membership
In the same product, most dangerous first.
CVE-2022-1724—Simple Membership < 4.1.1 - Reflected Cross-Site ScriptingEPSS 1.8%CVE-2022-2317—Simple Membership < 4.1.3 - Unauthenticated Membership Privilege EscalationEPSS 1.4%CVE-2022-2273—Simple Membership < 4.1.3 - Membership Privilege EscalationEPSS 1.2%CVE-2022-0681—Simple Membership < 4.1.0 - Arbitrary Transaction Deletion via CSRFEPSS 0.5%CVE-2026-11855HIGHSimple Membership < 4.7.5 - Unauthenticated Stored XSS via Stripe Webhook API VersionEPSS 0.5%CVE-2022-0328—Simple Membership < 4.0.9 - Arbitrary Member Deletion via CSRFEPSS 0.5%