Simple Membership Vulnerability – Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode – CVE-2024-3730 | WordPress Plugin Vulnerability Report

Plugin Name: Simple Membership

Key Information:

  • Software Type: Plugin
  • Software Slug: simple-membership
  • Software Status: Active
  • Software Author: mra13
  • Software Downloads: 2,505,346
  • Active Installs: 50,000
  • Last Updated: May 9, 2024
  • Patched Versions: 4.4.4
  • Affected Versions: <= 4.4.3

Vulnerability Details:

  • Name: Simple Membership <= 4.4.3
  • Title: Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-3730
  • CVSS Score: 5.4
  • Publicly Published: NA
  • Researcher: Thanh Nam Tran
  • Description: The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_link' shortcode in all versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping on user-supplied attributes. This vulnerability allows authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


The Simple Membership plugin for WordPress has a vulnerability in versions up to and including 4.4.3 that allows for the injection of malicious scripts by authenticated users with contributor-level access or higher. This vulnerability has been patched in version 4.4.4.

Detailed Overview:

This vulnerability, discovered by researcher Thanh Nam Tran, resides in the 'swpm_paypal_subscription_cancel_link' shortcode of the Simple Membership plugin. It allows attackers to perform stored cross-site scripting (XSS) attacks. The risk here includes the potential for attackers to steal cookies, hijack sessions, or redirect visitors to malicious websites. The vulnerability was due to insufficient input sanitization and output escaping. Remediation has been achieved in the latest patch, and users are encouraged to update to the secure version immediately.

Advice for Users:

  • Immediate Action: Update to version 4.4.4 immediately.
  • Check for Signs of Vulnerability: Review pages for unexpected scripts or redirections, especially if you notice odd browser behavior.
  • Alternate Plugins: While a patch is available, users might consider similar plugins as a precaution.
  • Stay Updated: Always ensure that your plugins are updated to the latest versions to avoid vulnerabilities.


The prompt response from the developers of Simple Membership to patch this vulnerability highlights the importance of timely updates. Users are advised to ensure that they are running version 4.4.4 or later to secure their WordPress installations.


Detailed Report: 

In the digital age, ensuring the security of your website is as crucial as locking the physical doors to your business. The revelation of a security vulnerability in the Simple Membership plugin for WordPress, identified as CVE-2024-3730, serves as a stark reminder of the risks posed by outdated software. This vulnerability exposes websites to attacks through stored cross-site scripting (XSS), which can lead to data theft, session hijacking, or redirecting visitors to malicious sites.

About Simple Membership

Simple Membership is a widely-used WordPress plugin designed to manage memberships. It boasts over 50,000 active installations and has been downloaded more than 2.5 million times. Despite its popularity and regular updates, the plugin has been vulnerable in the past, with this being the 19th recorded vulnerability since July 2016.

Understanding the Vulnerability

The recent vulnerability affects all versions of the Simple Membership plugin up to and including 4.4.3. It specifically involves the 'swpm_paypal_subscription_cancel_link' shortcode, which lacks sufficient input sanitization and output escaping, allowing attackers with at least contributor-level access to inject malicious scripts. This flaw was discovered by security researcher Thanh Nam Tran and is catalogued under CVE-2024-3730, with a CVSS score of 5.4, indicating a moderate level of risk.

Risks and Potential Impacts

The nature of this XSS vulnerability means that attackers could potentially steal cookies, hijack user sessions, or manipulate the pages viewed by visitors. This could compromise not only the security of the website but also the personal data of its users, potentially leading to financial loss or reputational damage.

Remediation Steps

To address this issue, the plugin developers have released version 4.4.4, which patches the vulnerability. Users of the Simple Membership plugin should:

  • Immediately update to version 4.4.4.
  • Review website pages for unexpected scripts or redirections.
  • Consider alternative plugins if updates cannot be immediately applied.
  • Regularly check for updates to ensure all software components are current.

Historical Context

This is not the first vulnerability reported for the Simple Membership plugin, with 18 previous incidents since 2016. These historical vulnerabilities highlight the importance of continuous monitoring and updating of all software used on your website.


The swift response from the developers of Simple Membership to fix the vulnerability underscores the critical importance of staying abreast of software updates. For small business owners, managing a WordPress website might seem daunting due to time constraints. However, neglecting this aspect can leave your digital presence vulnerable. Utilizing managed WordPress hosting services, subscribing to security blogs, or employing automatic update features are practical steps to mitigate these risks without overwhelming your schedule.

By proactively managing software updates and being vigilant about security advisories, small business owners can significantly reduce their vulnerability to cyber attacks and protect their online assets.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Simple Membership Vulnerability – Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode – CVE-2024-3730 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment