plugin
24 known security issues reported for the Wp Emember WordPress plugin. Most recent disclosed Jun 16, 2026.
Running Wp Emember on your site? Check whether your installed version is affected.
Scan your site freeThe Wp EMember plugin for WordPress is vulnerable to SQL Injection in versions up to v10.9.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existi...
The Wp EMember plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, v10.2.2. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.
The Wp EMember plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 10.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully tri...
The eMember plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 10.2.2. This makes it possible for unauthenticated attackers to perform an unauthorized action.
[en] The wp-eMember WordPress plugin before v10.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
The Wp EMember plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI'] in all versions up to, and including, 10.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that exec...
The Wp EMember plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 10.7.0 (exclusive). This is due to missing or incorrect nonce validation on the 'eMember_settings_menu' page. This makes it possible for unauthenticated attackers to update plugin settings and inject malicious web scri...
[en] The wp-eMember WordPress plugin before 10.6.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
[en] The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
[en] The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape some of the fields when members register, which allows unauthenticated users to perform Stored Cross-Site Scripting attacks
[en] The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
[en] The wp-eMember WordPress plugin before 10.6.6 does not validate files to be uploaded, which could allow admins to upload arbitrary files such as PHP on the server
[en] The wp-eMember WordPress plugin before 10.6.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
[en] The wp-eMember WordPress plugin before 10.6.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
[en] The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
The Wp EMember plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 10.6.5. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may m...
The Wp EMember plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 10.6.5. This is due to missing or incorrect nonce validation on the manage_blacklist() function. This makes it possible for unauthenticated attackers to inject malicious web scripts and update the black...
The Wp EMember plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the name fields in all versions up to, and including, 10.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute wh...
The Wp EMember plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'editrecord' parameter in all versions up to, and including, 10.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that e...
The Wp EMember plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'login_pwd' parameter in all versions up to, and including, 10.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that ex...
The Wp EMember plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'editrecord' parameter in all versions up to, and including, 10.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that e...
The Wp EMember plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 10.6.5. This is due to missing or incorrect nonce validation on the emember_payments page. This makes it possible for unauthenticated attackers to bulk delete payments via a forged request granted they...
[en] The wp-eMember WordPress plugin before 10.3.9 does not sanitize and escape the "fieldId" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
The WooCommerce and WP eMember Integration plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fieldId' parameter in all versions up to, and including, 10.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free