WishList Member vulnerabilities
We track 8 vulnerabilities in WishList Member products across 3 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on November 12, 2026.
Latest WishList Member vulnerabilities
- 8.8 High severity
CourseCure Courses: Improper Privilege Management
The CourseCure Courses plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.1. This is due to a missing capability check in the ajax_save_settings() function, which accepts arbitrary POST parameters and calls update_
- 9.8 Critical severity
Wishlist Member: Weak Password Recovery Mechanism for Forgotten Password
The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpm_register() function validating the registration cookie only against the
- 8.8 High severity
Wishlist Member: Improper Privilege Management
The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'WishListMember3_Hooks::generate_api_key' function in all versions up to, and including, 3.30.1. This makes it possible for aut
- 8.8 High severity
Wishlist Member: Improper Privilege Management
The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'WishListMember\Features\Team_Accounts::save_settings' function in all versions up to, and including, 3.30.1. This makes it pos
- 8.8 High severity
Wishlist Member: Improper Privilege Management
The WishList Member plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Disclosure and Privilege Escalation in versions up to and including 3.30.1. This is due to the missing capability checks in the 'export_settings' f
- 8.8 High severity
Wishlist Member: Improper Privilege Management
The WishList Member plugin for WordPress is vulnerable to Privilege Escalation via Missing Authorization in versions up to and including 3.30.1. This is due to the missing capability and nonce check in the ajax_get_screen() function. This makes it possible for
- 9.8 Critical severity
WishList Member X: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
- 9.8 Critical severity
WishList Member X: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.