WordSec
WordSec

ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup

Explore ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup vulnerabilities across all versions. Currently tracking 22 known vulnerabilities, including severity, impact, and patch status.

01234567891006.06.2022Today06.06.20229.8ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 3.4.7 -Authentication Bypass via Password Reset Weakness CVSS 9.8 · 06.06.202220.01.20234.3ARMember <= 3.4.10 - Missing Access Control leading to Authenticated (Subscriber+) Sensitive Information Disclosure CVSS 4.3 · 20.01.202327.03.20239.8ARMember <= 3.4.11 - Unauthenticated SQL Injection CVSS 9.8 · 27.03.202319.04.20236.1ARMember <= 4.0 - Reflected Cross-Site Scripting CVSS 6.1 · 19.04.202313.06.20234.4ARMember <= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 13.06.202327.06.20234.4ARMember <= 4.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 27.06.202305.07.20236.5ARMember <= 4.0.5 - Cross-Site Request Forgery CVSS 6.5 · 05.07.202310.07.20234.3ARMember <= 4.0.5 - Cross-Site Request Forgery CVSS 4.3 · 10.07.202314.07.20234.4ARMember Lite - Membership Plugin <= 4.0.16 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 14.07.202316.11.20234.3ARMember <= 4.0.10 - Authenticated (Subscriber+) Membership Plan Bypass CVSS 4.3 · 16.11.202326.12.20238.8ARMember <= 4.0.10 - Authenticated(Subscriber+) Privilege Escalation CVSS 8.8 · 26.12.202311.01.20246.3ARMember <= 4.0.22 - Cross-Site Request Forgery CVSS 6.3 · 11.01.202401.02.20245.3ARMember <= 4.0.24 - Improper Access Control to Sensitive Information Exposure via REST API CVSS 5.3 · 01.02.202415.03.20244.4ARMember <= 4.0.23 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 15.03.202426.03.20249.8ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.26 - Unauthenticated PHP Object Injection CVSS 9.8 · 26.03.20248.8ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.26 - Authenticated (Contributor+) PHP Object Injection CVSS 8.8 · 26.03.202404.04.20245.3ARMember <= 4.0.27 - Directory Traversal via X-FILENAME CVSS 5.3 · 04.04.202422.04.20245.3ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.28 - Missing Authorization CVSS 5.3 · 22.04.202429.04.20246.1ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.30 - Open Redirect CVSS 6.1 · 29.04.202416.08.20246.4ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.37 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload CVSS 6.4 · 16.08.202405.12.20246.3ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.51 - Authenticated (Subscriber+) Arbitrary Shortcode Execution CVSS 6.3 · 05.12.202401.05.20267.5ARMember <= 5.5 - Unauthenticated SQL Injection via 'orderby' Parameter CVSS 7.5 · 01.05.2026

Strategic Overview

Avg CVSSMedium
6.3/ 10
Patch Coverage100%
Open

0

Fixed

22

Get automatic notifications for all ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup vulnerabilities before they are exploited.

Vulnerability Records

22 records
2026-05-01 17:37
ARMember <= 5.5 - Unauthenticated SQL Injection via 'orderby' Parameter
ARMember
<= 5.5
CVE-2026-7649
7.5
High
Yuvraj TomarYes
2024-12-05 00:00
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.51 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
ARMember
<= 4.0.51
CVE-2024-10681
6.3
Medium
Arkadiusz HydzikYes
2024-08-16 23:05
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.37 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload
ARMember
<= 4.0.37
CVE-2024-7703
6.4
Medium
wesley (wcraft)Yes
2024-04-29 00:00
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.30 - Open Redirect
ARMember
<= 4.0.30
CVE-2024-4133
6.1
Medium
Krzysztof ZającYes
2024-04-22 00:00
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.28 - Missing Authorization
ARMember
<= 4.0.28
CVE-2024-32948
5.3
Medium
Kursat CetinYes
2024-04-04 00:00
ARMember <= 4.0.27 - Directory Traversal via X-FILENAME
ARMember
<= 4.0.27
CVE-2026-15302
5.3
Medium
Lucio SáYes
2024-03-26 00:00
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.26 - Unauthenticated PHP Object Injection
ARMember
<= 4.0.26
CVE-2024-30223
9.8
Critical
LVT-tholv2kYes
2024-03-26 00:00
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.26 - Authenticated (Contributor+) PHP Object Injection
ARMember
<= 4.0.26
CVE-2024-30222
8.8
High
LVT-tholv2kYes
2024-03-15 00:00
ARMember <= 4.0.23 - Authenticated (Administrator+) Stored Cross-Site Scripting
ARMember
<= 4.0.23
CVE-2024-27995
4.4
Medium
Van LyubovYes
2024-02-01 00:00
ARMember <= 4.0.24 - Improper Access Control to Sensitive Information Exposure via REST API
ARMember
<= 4.0.24
CVE-2024-0969
5.3
Medium
Francesco CarlucciYes
Showing 1–10 of 22 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C