ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup

ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup has 22 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 22 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 3 high. 2024 was the busiest year with 10 disclosures.

The most common weakness is Cross-Site Scripting, behind 6 of the records (27%). Other recurring categories include Cross-Site Request Forgery (CSRF), Missing Authorization.

Every one of the 22 issues recorded for ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup has a vendor fix available, so running the current release closes all known holes.

18 independent researchers contributed these findings, most of them (3) reported by Cat.

Strategic Overview

Avg CVSSMedium

6.3/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2024-30223

ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.26 - Unauthenticated PHP Object Injection

Read the full analysis

Vulnerability Records

22 records


2026-05-01 17:37	ARMember <= 5.5 - Unauthenticated SQL Injection via 'orderby' Parameter ARMember <= 5.5	`CVE-2026-7649`	7.5 High	Yuvraj Tomar	Yes
2024-12-05 00:00	ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.51 - Authenticated (Subscriber+) Arbitrary Shortcode Execution ARMember <= 4.0.51	`CVE-2024-10681`	6.3 Medium	Arkadiusz Hydzik	Yes
2024-08-16 23:05	ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.37 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload ARMember <= 4.0.37	`CVE-2024-7703`	6.4 Medium	wesley (wcraft)	Yes
2024-04-29 00:00	ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.30 - Open Redirect ARMember <= 4.0.30	`CVE-2024-4133`	6.1 Medium	Krzysztof Zając	Yes
2024-04-22 00:00	ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.28 - Missing Authorization ARMember <= 4.0.28	`CVE-2024-32948`	5.3 Medium	Kursat Cetin	Yes
2024-04-04 00:00	ARMember <= 4.0.27 - Directory Traversal via X-FILENAME ARMember <= 4.0.27	`CVE-2026-15302`	5.3 Medium	Lucio Sá	Yes
2024-03-26 00:00	ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.26 - Unauthenticated PHP Object Injection ARMember <= 4.0.26	`CVE-2024-30223`	9.8 Critical	LVT-tholv2k	Yes
2024-03-26 00:00	ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.26 - Authenticated (Contributor+) PHP Object Injection ARMember <= 4.0.26	`CVE-2024-30222`	8.8 High	LVT-tholv2k	Yes
2024-03-15 00:00	ARMember <= 4.0.23 - Authenticated (Administrator+) Stored Cross-Site Scripting ARMember <= 4.0.23	`CVE-2024-27995`	4.4 Medium	Van Lyubov	Yes
2024-02-01 00:00	ARMember <= 4.0.24 - Improper Access Control to Sensitive Information Exposure via REST API ARMember <= 4.0.24	`CVE-2024-0969`	5.3 Medium	Francesco Carlucci	Yes

Showing 1–10 of 22 reports