Memberpress

Memberpress has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; all 7 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 8.5 out of 10. Severity breakdown: 0 critical and 1 high. 2024 was the busiest year with 5 disclosures.

The most common weakness is Cross-Site Scripting, behind 4 of the records (57%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Missing Authorization.

Every one of the 7 issues recorded for Memberpress has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, most of them (3) reported by stealthcopter.

01234567891021.03.2024Today21.03.20246.1Memberpress <= 1.11.24 - Reflected Cross-Site Scripting via message and error CVSS 6.1 · 21.03.202421.05.20246.4MemberPress <= 1.11.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via arglist Parameter CVSS 6.4 · 21.05.20248.5MemberPress <= 1.11.29 - Authenticated (Contributor+) Blind Server-Side Request Forgery via mepr-user-file Shortcode CVSS 8.5 · 21.05.202426.08.20245.3Memberpress <= 1.11.34 - Missing Authorization CVSS 5.3 · 26.08.202429.08.20246.1MemberPress <= 1.11.29 - Reflected Cross-Site Scripting via mepr_screenname and mepr_key Parameters CVSS 6.1 · 29.08.202417.04.20256.1Memberpress < 1.12.0 - Reflected Cross-Site Scripting CVSS 6.1 · 17.04.202521.04.20255.3Memberpress <= 1.11.37 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure CVSS 5.3 · 21.04.2025

Strategic Overview

Avg CVSSMedium
6.3/ 10
Patch Coverage100%
Open

0

Fixed

7

Get automatic notifications for all Memberpress vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.5CVE-2024-5031

MemberPress <= 1.11.29 - Authenticated (Contributor+) Blind Server-Side Request Forgery via mepr-user-file Shortcode

Read the full analysis

Vulnerability Records

7 records
2025-04-21 00:00
Memberpress <= 1.11.37 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
Memberpress
<= 1.11.37
CVE-2024-11299
5.3
Medium
Francesco CarlucciYes
2025-04-17 00:00
Memberpress < 1.12.0 - Reflected Cross-Site Scripting
Memberpress
< 1.12.0
CVE-2025-39407
6.1
Medium
0xd4rk5id3Yes
2024-08-29 15:03
MemberPress <= 1.11.29 - Reflected Cross-Site Scripting via mepr_screenname and mepr_key Parameters
Memberpress
<= 1.11.29
CVE-2024-5024
6.1
Medium
stealthcopterYes
2024-08-26 00:00
Memberpress <= 1.11.34 - Missing Authorization
Memberpress
<= 1.11.34
CVE-2024-43956
5.3
Medium
Ananda DhakalYes
2024-05-21 20:06
MemberPress <= 1.11.29 - Authenticated (Contributor+) Blind Server-Side Request Forgery via mepr-user-file Shortcode
Memberpress
<= 1.11.29
CVE-2024-5031
8.5
High
stealthcopterYes
2024-05-21 20:02
MemberPress <= 1.11.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via arglist Parameter
Memberpress
<= 1.11.29
CVE-2024-5025
6.4
Medium
stealthcopterYes
2024-03-21 00:00
Memberpress <= 1.11.24 - Reflected Cross-Site Scripting via message and error
Memberpress
<= 1.11.26
CVE-2024-1412
6.1
Medium
Jamie PerreletYes
Showing 1–7 of 7 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C