MemberHero – Simple User Registration & Login

MemberHero – Simple User Registration & Login has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; 5 are fixed and 2 remain unpatched as of September 2026. Their average CVSS score is 8.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 4 high. 2025 was the busiest year with 3 disclosures.

The most common weakness is Improper Privilege Management, behind 3 of the records (43%). Other recurring categories include Missing Authorization, Cross-Site Scripting.

5 of the records (71%) have a vendor fix, while 2 remain unpatched. The oldest unresolved one dates back to 2025.

6 independent researchers contributed these findings, most of them (2) reported by stealthcopter. MemberHero – Simple User Registration & Login is installed on roughly 200 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSHigh

8.7/ 10

Patch Coverage71%

Open

Fixed

Get automatic notifications for all MemberHero – Simple User Registration & Login vulnerabilities before they are exploited.

Most severe open issueCVSS 8.8CVE-2025-53428

Simple User Registration <= 6.4 - Authenticated (Contributor+) Privilege Escalation

Read the full analysis

Vulnerability Records

7 records


2026-08-31 00:00	MemberHero – Simple User Registration & Login <= 6.9 - Unauthenticated Privilege Escalation MemberHero <= 6.9	`CVE-2026-10522`	7.3 High	Khaled Alenazi	No
2026-01-27 21:50	Simple User Registration <= 6.7 - Authenticated (Subscriber+) Privilege Escalation via profile_save_field MemberHero <= 6.7	`CVE-2026-0844`	8.8 High	johska	Yes
2025-11-20 00:00	Simple User Registration <= 6.6 - Unauthenticated Stored Cross-Site Scripting MemberHero <= 6.6	`CVE-2025-12160`	7.2 High	Athiwat Tiprasaharn (Jitlada)	Yes
2025-09-20 00:00	Simple User Registration <= 6.4 - Authenticated (Contributor+) Privilege Escalation MemberHero <= 6.4	`CVE-2025-53428`	8.8 High	Peter Thaleikis	No
2025-06-25 13:47	Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation MemberHero <= 6.3	`CVE-2025-4334`	9.8 Critical	Chuck	Yes
2024-12-02 00:00	Simple User Registration <= 5.5 - Missing Authorization to User Deletion MemberHero <= 5.5	`CVE-2024-53810`	9.1 Critical	stealthcopter	Yes
2024-10-17 00:00	Simple User Registration <= 6.7 - Missing Authorization to Account Takeover MemberHero <= 6.7	`CVE-2024-49604`	9.8 Critical	stealthcopter	Yes

Showing 1–7 of 7 reports

Latestv6.9

MemberHero – Simple User Registration & Login

Author

N-Media

4.4(27)

88/100

Last Updated

2026-07-28 (2mo ago)

Active Installs

200+

Downloads

98,231

Requires WP

3.5+

Requires PHP

Tested up to

WP 7.0.4

Created

2014-10-23 (12y ago)

A Simple WordPress plugin to turn your site into a membership site. It will generate all necessary pages required for any membership site. Awesome drag and drop field editor creates signup page so quickly. Members can manage profile on frontend. For More Detail See Video Below: See More Videos Demo How to use Plugin Guide Plugin Features Unlimited Members Forms Auto Generate Member Pages Manage Redirects User Profile Dashboard Profile Based URL Edit Profile New User Notifications Translation Ready Pro Features Multi-step Registration More Input Fields Change Password Restrict Pages by Role Hide Admin Bar Member Direclty Auto Login Email Verification Manual Verification Activate/Deactivate Members Singup By Role GDPR Settings Email Templates Templates Override Fields Privacy Control Redirects by Role Fields Icons Form Design Login PopUp Google reCAPTCHA Integration with MailChimp and SendinBlue Visite for more detail Quick Message to Members Since version 4.3, Admin can message via email to selected members from Dashboard with subject. See screenshot-16

View on WordPress.org