Memberpress

Memberpress has 8 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 8 are fixed as of October 2026. Their average CVSS score is 6.6, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2024 was the busiest year with 5 disclosures.

The most common weakness is Cross-Site Scripting, behind 4 of the records (50%). Other recurring categories include Cross-Site Request Forgery (CSRF), Exposure Of Sensitive Information To An Unauthorized Actor.

Every one of the 8 issues recorded for Memberpress has a vendor fix available, so running the current release closes all known holes.

6 independent researchers contributed these findings, most of them (3) reported by stealthcopter.

Strategic Overview

Avg CVSSMedium

6.6/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Memberpress vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2026-92797

Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter

Read the full analysis

Vulnerability Records

8 records


2026-10-27 00:00	Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter Memberpress <= 1.14.1	`CVE-2026-92797`	8.8 High	Matthew Cowan	Yes
2025-04-21 00:00	Memberpress <= 1.11.37 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure Memberpress <= 1.11.37	`CVE-2024-11299`	5.3 Medium	Francesco Carlucci	Yes
2025-04-17 00:00	Memberpress < 1.12.0 - Reflected Cross-Site Scripting Memberpress < 1.12.0	`CVE-2025-39407`	6.1 Medium	0xd4rk5id3	Yes
2024-08-29 15:03	MemberPress <= 1.11.29 - Reflected Cross-Site Scripting via mepr_screenname and mepr_key Parameters Memberpress <= 1.11.29	`CVE-2024-5024`	6.1 Medium	stealthcopter	Yes
2024-08-26 00:00	Memberpress <= 1.11.34 - Missing Authorization Memberpress <= 1.11.34	`CVE-2024-43956`	5.3 Medium	Ananda Dhakal	Yes
2024-05-21 20:06	MemberPress <= 1.11.29 - Authenticated (Contributor+) Blind Server-Side Request Forgery via mepr-user-file Shortcode Memberpress <= 1.11.29	`CVE-2024-5031`	8.5 High	stealthcopter	Yes
2024-05-21 20:02	MemberPress <= 1.11.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via arglist Parameter Memberpress <= 1.11.29	`CVE-2024-5025`	6.4 Medium	stealthcopter	Yes
2024-03-21 00:00	Memberpress <= 1.11.24 - Reflected Cross-Site Scripting via message and error Memberpress <= 1.11.26	`CVE-2024-1412`	6.1 Medium	Jamie Perrelet	Yes

Showing 1–8 of 8 reports