Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 253,029 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · wp-emember
WP eMember
14 known vulnerabilities on record. Add your version above to see which ones affect you.
Jun 17, 2026Unauthenticated SQL Injection in WP eMember < v10.9.4 versions.CVE-2026-54811 · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP eMember < v10.9.4 versions.
Jun 4, 2026WP eMember: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-49077 · affects up to v10.2.2 · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Tips and Tricks HQ WP eMember allows Retrieve Embedded Sensitive Data. This issue affects WP eMember: from n/a through v10.2.2.
Mar 19, 2026WP eMember: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28073 · affects up to v10.2.2 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tips and Tricks HQ WP eMember allows Reflected XSS.This issue affects WP eMember: from n/a through v10.2.2.
Mar 19, 2026WP eMember: Missing AuthorizationCVE-2026-28070 · affects up to v10.2.2 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Tips and Tricks HQ WP eMember allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP eMember: from n/a through v10.2.2.
Aug 5, 2024wp-eMember: Does not have CSRF check in some placesCVE-2024-5081 · fixed in 10.7.0 · reported by WPScanMedium 6.1
The wp-eMember WordPress plugin before v10.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
Jul 13, 2024wp-eMember: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-5744 · fixed in 10.6.7 · reported by WPScanMedium 6.8
The wp-eMember WordPress plugin before 10.6.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Jul 13, 2024wp-eMember: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5715 · fixed in 10.6.7 · reported by WPScanHigh 7.1
The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Jul 13, 2024wp-eMember: Does not validate files to be uploadedCVE-2024-5080 · fixed in 10.6.6 · reported by WPScanHigh 8.8
The wp-eMember WordPress plugin before 10.6.6 does not validate files to be uploaded, which could allow admins to upload arbitrary files such as PHP on the server
Jul 13, 2024wp-eMember: Does not sanitise and escape some of the fieldsCVE-2024-5079 · fixed in 10.6.7 · reported by WPScanMedium 6.1
The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape some of the fields when members register, which allows unauthenticated users to perform Stored Cross-Site Scripting attacks
Jul 13, 2024wp-eMember: Does not have CSRF check in some placesCVE-2024-5077 · fixed in 10.6.6 · reported by WPScanMedium 6.8
The wp-eMember WordPress plugin before 10.6.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
Jul 13, 2024wp-eMember: Does not have CSRF checks in some placesCVE-2024-5076 · fixed in 10.6.6 · reported by WPScanHigh 8.8
The wp-eMember WordPress plugin before 10.6.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
Jul 13, 2024wp-eMember: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5075 · fixed in 10.6.6 · reported by WPScanMedium 5.9
The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Jul 13, 2024wp-eMember: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5074 · fixed in 10.6.6 · reported by WPScanMedium 5.4
The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Jun 4, 2024wp-eMember: Does not sanitize and escape the "fieldId" parameter before outputting it back in the pageCVE-2024-4749 · fixed in 10.3.9 · reported by WPScanHigh 8.3
The wp-eMember WordPress plugin before 10.3.9 does not sanitize and escape the "fieldId" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.