Cross-site Scripting Vulnerability in Simple Membership Plugin by WordPress
CVE-2025-49333

5.9MEDIUM

Key Information:

Vendor

WordPress
Status
Simple Membership
Vendor
CVE Published:
6 June 2025

What is CVE-2025-49333?

The Simple Membership plugin for WordPress is susceptible to a Cross-site Scripting (XSS) vulnerability due to improper sanitization of user input during web page generation. This security flaw permits an attacker to store malicious scripts that can be executed within the context of a user’s session. Affected versions include all prior to 4.6.3, leaving users exposed to potential data theft and other malicious actions via compromised web pages.

Affected Version(s)

Simple Membership <= 4.6.3

References

https://patchstack.com/database/wordpress/plugin/simple-m...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

bintable (Patchstack Alliance)
.