Simple Membership

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

420 searches this plugin appeared in over the last 90 days, 20 listed. 390 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 2 years ago; a band this size takes about a year or more to cross, which places it about 50% of the way through.

1. ★★★★★ johnthomasin

   4mo ago

   Working on this plugin was an absolute blast. It’s truly an awesome Membership plugin!

   Read on wp.org ↗
2. ★★★★★ heikkiheer

   4mo ago

   Does what you want and way more!

   Read on wp.org ↗
3. ★★★★★ jackhb1959

   4mo ago

   I am a newbie, and it was easy enough to use.

   Read on wp.org ↗
4. ★★★★★ akashandnila

   5mo ago

   This plugin has lots of features in the free version. The documentation is superb. And if you need more, there are paid add-ons. “Simple” does not mean low quality or few features. It is really a professional level plugin.

   Read on wp.org ↗
5. ★★★★★ ddaneskovic

   5mo ago

   It helps a lot for different memberships.

   Read on wp.org ↗
6. ★★★★★ mlcmike

   6mo ago

   so far it works very well thanks

   Read on wp.org ↗
7. ★★★★★ Markku Holopainen

   7mo ago

   I have tested various plugins for creating and controlling members in various levels. This is the only plugin which I trust totally. It is very easy to create user groups/levels and users in different levels which have access to the different pages. This plugin really prevents lower level users to access the higher level pages. Thank you for an excellent product.

   Read on wp.org ↗
8. ★★★★★ ramsok2020

   7mo ago

   Questo plugin è la soluzione perfetta per chi vuole realizzare l’accesso a vari livelli di abbonamento (gratuito ma con registrazione delle credenziali, oppure a pagamento) per i propri utenti: chiaro e semplice da configurare, ma davvero potente e ben funzionante.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 4.7.8 Added validation of the ‘subscr_ref’ parameter in the PayPal standard IPN handling code. Thank you to Charles Vosburgh for reporting this. Added sanitization to the PayPal payment notification handling code. Thanks to Ya 4.7.8
2. — Version 4.7.7 Removed the obsolete PayPal Smart Checkout related code to clean up the codebase. The PayPal Standard IPN data validation now also validates the merchant/receiver email. Thank you to Muni Nitish Kumar for reporting this. 4.7.7
3. — Version 4.7.6 Important Note: A Stripe webhook signing secret is now required to process Stripe subscription webhook events. This provides an additional layer of security. If you are using Stripe subscription payment buttons, please m 4.7.6
4. — Version 4.7.5 Fixed an issue with the bulk account activation notification email. Stripe subscription webhook: fixed a security issue. 4.7.5
5. — Version 4.7.4 Fixed a bug related to the annual expiry date settings. Login event timestamps are now recorded according to the WordPress site’s timezone settings. Added an admin notice that displays when a Stripe webhook is received f 4.7.4
6. — Version 4.7.3 Added a new action hook ‘swpm_ipn_account_upgrade_event’ that is triggered when an account upgrade event is processed in the IPN handler. Added a new action hook ‘swpm_ipn_account_renewal_event’ that is triggered when an 4.7.3

All 39 disclosed vulnerabilities are patched in the current version (4.8.6). Sites still on an older version should update.

1. Patched Medium · 6.4 Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field ↗
   2026-10-09 CVE-2026-103427 Improper Neutralization of Input During Web Page Generation Affects <= 4.8.4 Patched in 4.8.5
2. Patched Low · 3.1 Simple Membership <= 4.8.2 - Information Exposure ↗
   2026-10-09 CVE-2026-88785 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 4.8.2 Patched in 4.8.3
3. Patched High · 7.5 Simple Membership <= 4.8.3 - Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints ↗
   2026-10-02 CVE-2026-97337 Missing Authorization Affects <= 4.8.3 Patched in 4.8.4
4. Patched Medium · 4.3 Simple Membership <= 4.8.2 - Missing Authorization ↗
   2026-09-16 CVE-2026-74000 Missing Authorization Affects <= 4.8.2 Patched in 4.8.3
5. Patched Medium · 4.3 Simple Membership < 4.7.8 - Missing Authorization ↗
   2026-09-11 CVE-2026-88764 Missing Authorization Affects < 4.7.8 Patched in 4.7.8
6. Patched Medium · 5.3 Simple Membership <= 4.8.1 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding ↗
   2026-08-31 CVE-2026-77194 Improper Authentication Affects <= 4.8.1 Patched in 4.8.2
7. Patched Medium · 5.3 Simple Membership <= 4.7.8 - Missing Authorization ↗
   2026-08-05 CVE-2026-66712 Missing Authorization Affects <= 4.7.8 Patched in 4.7.9
8. Patched Medium · 5.3 Simple Membership <= 4.7.7 - Missing Authorization ↗
   2026-07-24 CVE-2026-15930 Missing Authorization Affects <= 4.7.7 Patched in 4.7.8
9. Patched High · 7.2 Simple Membership <= 4.7.7 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-07-24 CVE-2026-15931 Improper Neutralization of Input During Web Page Generation Affects <= 4.7.7 Patched in 4.7.8
10. Patched Medium · 5.3 Simple Membership <= 4.7.6 - Unauthenticated Payment Verification Bypass ↗
    2026-07-13 CVE-2026-14936 Insufficient Verification of Data Authenticity Affects <= 4.7.6 Patched in 4.7.7
11. Patched Medium · 5.3 Simple Membership <= 4.7.5 - Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook ↗
    2026-06-17 CVE-2026-12093 Missing Authorization Affects <= 4.7.5 Patched in 4.7.6
12. Patched High · 7.2 Simple Membership <= 4.7.4 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-06-15 CVE-2026-11855 Improper Neutralization of Input During Web Page Generation Affects <= 4.7.4 Patched in 4.7.5
13. Patched High · 7.2 Simple Membership <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-05-03 CVE-2026-42663 Improper Neutralization of Input During Web Page Generation Affects <= 4.7.2 Patched in 4.7.3
14. Patched Medium · 5.3 Simple Membership <= 4.7.1 - Missing Authorization ↗
    2026-03-31 CVE-2026-34886 Missing Authorization Affects <= 4.7.1 Patched in 4.7.2
15. Patched Medium · 6.5 Simple Membership <= 4.7.0 - Unauthenticated Improper Handling of Missing Values ↗
    2026-02-18 CVE-2026-1461 Improper Handling of Missing Values Affects <= 4.7.0 Patched in 4.7.1
16. Patched Medium · 4.3 Simple Membership <= 4.6.9 - Missing Authorization ↗
    2026-01-19 CVE-2026-25308 Missing Authorization Affects <= 4.6.9 Patched in 4.7.0
17. Patched Medium · 4.4 Simple Membership <= 4.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2025-06-05 CVE-2025-49333 Improper Neutralization of Input During Web Page Generation Affects <= 4.6.3 Patched in 4.6.4
18. Patched Medium · 5.3 Simple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized Actor ↗
    2024-11-20 CVE-2024-11088 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 4.5.5 Patched in 4.5.6
19. Patched Medium · 6.1 Simple Membership <= 4.5.3 - Unauthenticated Open Redirect ↗
    2024-10-21 CVE-2024-49682 URL Redirection to Untrusted Site Affects <= 4.5.3 Patched in 4.5.4
20. Patched Medium · 6.4 Simple Membership <= 4.4.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2024-05-03 CVE-2024-4383 Improper Neutralization of Input During Web Page Generation Affects <= 4.4.5 Patched in 4.4.6
21. Patched Medium · 5.4 Simple Membership <= 4.4.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2024-04-24 CVE-2024-3730 Improper Neutralization of Input During Web Page Generation Affects <= 4.4.3 Patched in 4.4.4
22. Patched Medium · 4.7 Simple Membership <= 4.4.2 - Unauthenticated Stored Self-Based Cross-Site Scripting ↗
    2024-03-05 CVE-2024-1985 Improper Neutralization of Input During Web Page Generation Affects <= 4.4.2 Patched in 4.4.3
23. Patched Medium · 6.1 Simple Membership <= 4.4.1 - Open Redirect ↗
    2024-01-19 CVE-2024-22308 URL Redirection to Untrusted Site Affects <= 4.4.1 Patched in 4.4.2
24. Patched Medium · 6.1 Simple Membership <= 4.3.8 - Reflected Cross-Site Scripting ↗
    2023-12-19 CVE-2023-50376 Improper Neutralization of Input During Web Page Generation Affects < 4.3.9 Patched in 4.3.9
25. Patched Medium · 6.1 Simple Membership <= 4.3.8 - Reflected Cross-Site Scripting Vulnerability via environment_mode ↗
    2023-12-18 CVE-2023-6882 Improper Neutralization of Input During Web Page Generation Affects <= 4.3.8 Patched in 4.3.9
26. Patched High · 7.3 Simple Membership <= 4.3.4 - Privilege escalation via Registration ↗
    2023-09-25 CVE-2023-41957 Improper Input Validation Affects <= 4.3.4 Patched in 4.3.5
27. Patched High · 8.8 Simple Membership <= 4.3.4 - Account Takeover via Password Reset ↗
    2023-09-25 CVE-2023-41956 Improper Input Validation Affects <= 4.3.4 Patched in 4.3.5
28. Patched High · 7.2 Simple Membership <= 4.3.5 - Reflected Cross-Site Scripting ↗
    2023-09-05 CVE-2023-4719 Improper Neutralization of Input During Web Page Generation Affects <= 4.3.5 Patched in 4.3.6
29. Patched Medium · 6.4 Simple Membership <= 4.2.1 - Authenticated (Contributor+) Cross Site Scripting via shortcode ↗
    2022-12-21 CVE-2022-4469 Improper Neutralization of Input During Web Page Generation Affects <= 4.2.1 Patched in 4.2.2
30. Patched Critical · 9.8 Simple Membership <= 4.1.2 - Membership Privilege Escalation ↗
    2022-07-06 CVE-2022-2317 Improper Privilege Management Affects <= 4.1.2 Patched in 4.1.3
31. Patched High · 8.8 Simple Membership <= 4.1.2 - Membership Privilege Escalation ↗
    2022-07-06 CVE-2022-2273 Improper Privilege Management Affects <= 4.1.2 Patched in 4.1.3
32. Patched Medium · 6.1 Simple Membership <= 4.1.0 - Reflected Cross-Site Scripting ↗
    2022-05-23 CVE-2022-1724 Improper Neutralization of Input During Web Page Generation Affects <= 4.1.0 Patched in 4.1.1
33. Patched Medium · 6.5 Simple Membership <= 4.0.9 - Cross-Site Request Forgery to Arbitrary Transaction Deletion ↗
    2022-02-25 CVE-2022-0681 Cross-Site Request Forgery Affects < 4.1.0 Patched in 4.1.0
34. Patched High · 8.8 Simple Membership <= 4.0.8 - Cross-Site Request Forgery to Arbitrary Member Deletion ↗
    2022-01-25 CVE-2022-0328 Cross-Site Request Forgery Affects < 4.0.9 Patched in 4.0.9
35. Patched High · 7.2 Simple Membership <= 4.0.3 - Authenticated (Admin+) SQL Injections ↗
    2021-04-05 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.0.3 Patched in 4.0.4
36. Patched High · 8.8 Simple Membership <= 3.8.4 - Cross-Site Request Forgery ↗
    2019-07-27 CVE-2019-14328 Cross-Site Request Forgery Affects < 3.8.5 Patched in 3.8.5
37. Patched Medium · 6.1 Simple Membership <= 3.5.6 - Cross-Site Scripting ↗
    2017-11-08 CVE-2017-18499 Improper Neutralization of Input During Web Page Generation Affects < 3.5.7 Patched in 3.5.7
38. Patched High · 8.8 Simple Membership <= 3.3.2 - Multiple Cross-Site Request Forgery ↗
    2016-09-16 CVE-2016-10884 Cross-Site Request Forgery Affects <= 3.3.2 Patched in 3.3.3
39. Patched Medium · 6.1 Simple Membership < 3.2.9 - Reflected Cross-Site Scripting ↗
    2016-07-14 Improper Neutralization of Input During Web Page Generation Affects < 3.2.9 Patched in 3.2.9

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 52 languages, 3 at 90% or more

Plus 28 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2024-10-26 50K+ → 40K+ down after 1 days in tier
2. 2024-10-25 40K+ → 50K+ up after 1 days in tier
3. 2024-10-24 50K+ → 40K+ down after 2 days in tier
4. 2024-10-22 40K+ → 50K+ up after 1 days in tier
5. 2024-10-21 50K+ → 40K+ down after 1 days in tier
6. 2024-10-20 40K+ → 50K+ up after 2 days in tier
7. 2024-10-18 50K+ → 40K+ down after 1 days in tier
8. 2024-10-17 40K+ → 50K+ up after 1 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Simple Membership into a readme, a review or a deck. It updates itself.

Simple Membership: 40K+ active installs, 4.6★ (475 reviews). Plugin Pulse (WP Mayor), as of 2026-11-01. https://plugins.wpmayor.com/plugin/simple-membership