Simple Membership

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price.

1. ★★★★★ johnthomasin

   2mo ago

   Working on this plugin was an absolute blast. It’s truly an awesome Membership plugin!

   Read on wp.org ↗
2. ★★★★★ heikkiheer

   2mo ago

   Does what you want and way more!

   Read on wp.org ↗
3. ★★★★★ jackhb1959

   2mo ago

   I am a newbie, and it was easy enough to use.

   Read on wp.org ↗
4. ★★★★★ akashandnila

   2mo ago

   This plugin has lots of features in the free version. The documentation is superb. And if you need more, there are paid add-ons. “Simple” does not mean low quality or few features. It is really a professional level plugin.

   Read on wp.org ↗
5. ★★★★★ ddaneskovic

   3mo ago

   It helps a lot for different memberships.

   Read on wp.org ↗
6. ★★★★★ mlcmike

   3mo ago

   so far it works very well thanks

   Read on wp.org ↗
7. ★★★★★ Markku Holopainen

   5mo ago

   I have tested various plugins for creating and controlling members in various levels. This is the only plugin which I trust totally. It is very easy to create user groups/levels and users in different levels which have access to the different pages. This plugin really prevents lower level users to access the higher level pages. Thank you for an excellent product.

   Read on wp.org ↗
8. ★★★★★ ramsok2020

   5mo ago

   Questo plugin è la soluzione perfetta per chi vuole realizzare l’accesso a vari livelli di abbonamento (gratuito ma con registrazione delle credenziali, oppure a pagamento) per i propri utenti: chiaro e semplice da configurare, ma davvero potente e ben funzionante.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 4.7.8 Added validation of the ‘subscr_ref’ parameter in the PayPal standard IPN handling code. Thank you to Charles Vosburgh for reporting this. Added sanitization to the PayPal payment notification handling code. Thanks to Ya 4.7.8
2. — Version 4.7.7 Removed the obsolete PayPal Smart Checkout related code to clean up the codebase. The PayPal Standard IPN data validation now also validates the merchant/receiver email. Thank you to Muni Nitish Kumar for reporting this. 4.7.7
3. — Version 4.7.6 Important Note: A Stripe webhook signing secret is now required to process Stripe subscription webhook events. This provides an additional layer of security. If you are using Stripe subscription payment buttons, please m 4.7.6
4. — Version 4.7.5 Fixed an issue with the bulk account activation notification email. Stripe subscription webhook: fixed a security issue. 4.7.5
5. — Version 4.7.4 Fixed a bug related to the annual expiry date settings. Login event timestamps are now recorded according to the WordPress site’s timezone settings. Added an admin notice that displays when a Stripe webhook is received f 4.7.4
6. — Version 4.7.3 Added a new action hook ‘swpm_ipn_account_upgrade_event’ that is triggered when an account upgrade event is processed in the IPN handler. Added a new action hook ‘swpm_ipn_account_renewal_event’ that is triggered when an 4.7.3

32 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 5.3 Simple Membership <= 4.7.8 - Missing Authorization ↗
   2026-08-05 CVE-2026-66712 Missing Authorization Affects <= 4.7.8 Patched in 4.7.9
2. Medium · 5.3 Simple Membership <= 4.7.7 - Missing Authorization ↗
   2026-07-24 CVE-2026-15930 Missing Authorization Affects <= 4.7.7 Patched in 4.7.8
3. High · 7.2 Simple Membership <= 4.7.7 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-07-24 CVE-2026-15931 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.7.7 Patched in 4.7.8
4. Medium · 5.3 Simple Membership <= 4.7.6 - Unauthenticated Payment Verification Bypass ↗
   2026-07-13 CVE-2026-14936 Insufficient Verification of Data Authenticity Affects <= 4.7.6 Patched in 4.7.7
5. Medium · 5.3 Simple Membership <= 4.7.5 - Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook ↗
   2026-06-17 CVE-2026-12093 Missing Authorization Affects <= 4.7.5 Patched in 4.7.6
6. High · 7.2 Simple Membership <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-05-03 CVE-2026-42663 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.7.2 Patched in 4.7.3
7. Medium · 5.3 Simple Membership <= 4.7.1 - Missing Authorization ↗
   2026-03-31 CVE-2026-34886 Missing Authorization Affects <= 4.7.1 Patched in 4.7.2
8. Medium · 6.5 Simple Membership <= 4.7.0 - Unauthenticated Improper Handling of Missing Values ↗
   2026-02-18 CVE-2026-1461 Improper Handling of Missing Values Affects <= 4.7.0 Patched in 4.7.1
9. Medium · 4.3 Simple Membership <= 4.6.9 - Missing Authorization ↗
   2026-01-19 CVE-2026-25308 Missing Authorization Affects <= 4.6.9 Patched in 4.7.0
10. Medium · 4.4 Simple Membership <= 4.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2025-06-05 CVE-2025-49333 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.6.3 Patched in 4.6.4
11. Medium · 5.3 Simple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized Actor ↗
    2024-11-20 CVE-2024-11088 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 4.5.5 Patched in 4.5.6
12. Medium · 6.1 Simple Membership <= 4.5.3 - Unauthenticated Open Redirect ↗
    2024-10-21 CVE-2024-49682 URL Redirection to Untrusted Site ('Open Redirect') Affects <= 4.5.3 Patched in 4.5.4
13. Medium · 6.4 Simple Membership <= 4.4.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2024-05-03 CVE-2024-4383 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.4.5 Patched in 4.4.6
14. Medium · 5.4 Simple Membership <= 4.4.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2024-04-24 CVE-2024-3730 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.4.3 Patched in 4.4.4
15. Medium · 4.7 Simple Membership <= 4.4.2 - Unauthenticated Stored Self-Based Cross-Site Scripting ↗
    2024-03-05 CVE-2024-1985 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.4.2 Patched in 4.4.3
16. Medium · 6.1 Simple Membership <= 4.4.1 - Open Redirect ↗
    2024-01-19 CVE-2024-22308 URL Redirection to Untrusted Site ('Open Redirect') Affects <= 4.4.1 Patched in 4.4.2
17. Medium · 6.1 Simple Membership <= 4.3.8 - Reflected Cross-Site Scripting ↗
    2023-12-19 CVE-2023-50376 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 4.3.9 Patched in 4.3.9
18. Medium · 6.1 Simple Membership <= 4.3.8 - Reflected Cross-Site Scripting Vulnerability via environment_mode ↗
    2023-12-18 CVE-2023-6882 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.3.8 Patched in 4.3.9
19. High · 7.3 Simple Membership <= 4.3.4 - Privilege escalation via Registration ↗
    2023-09-25 CVE-2023-41957 Improper Input Validation Affects <= 4.3.4 Patched in 4.3.5
20. High · 8.8 Simple Membership <= 4.3.4 - Account Takeover via Password Reset ↗
    2023-09-25 CVE-2023-41956 Improper Input Validation Affects <= 4.3.4 Patched in 4.3.5
21. High · 7.2 Simple Membership <= 4.3.5 - Reflected Cross-Site Scripting ↗
    2023-09-05 CVE-2023-4719 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.3.5 Patched in 4.3.6
22. Medium · 6.4 Simple Membership <= 4.2.1 - Authenticated (Contributor+) Cross Site Scripting via shortcode ↗
    2022-12-21 CVE-2022-4469 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.2.1 Patched in 4.2.2
23. Critical · 9.8 Simple Membership <= 4.1.2 - Membership Privilege Escalation ↗
    2022-07-06 CVE-2022-2317 Improper Privilege Management Affects <= 4.1.2 Patched in 4.1.3
24. High · 8.8 Simple Membership <= 4.1.2 - Membership Privilege Escalation ↗
    2022-07-06 CVE-2022-2273 Improper Privilege Management Affects <= 4.1.2 Patched in 4.1.3
25. Medium · 6.1 Simple Membership <= 4.1.0 - Reflected Cross-Site Scripting ↗
    2022-05-23 CVE-2022-1724 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.1.0 Patched in 4.1.1
26. Medium · 6.5 Simple Membership <= 4.0.9 - Cross-Site Request Forgery to Arbitrary Transaction Deletion ↗
    2022-02-25 CVE-2022-0681 Cross-Site Request Forgery (CSRF) Affects < 4.1.0 Patched in 4.1.0
27. High · 8.8 Simple Membership <= 4.0.8 - Cross-Site Request Forgery to Arbitrary Member Deletion ↗
    2022-01-25 CVE-2022-0328 Cross-Site Request Forgery (CSRF) Affects < 4.0.9 Patched in 4.0.9
28. High · 7.2 Simple Membership <= 4.0.3 - Authenticated (Admin+) SQL Injections ↗
    2021-04-05 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 4.0.3 Patched in 4.0.4
29. High · 8.8 Simple Membership <= 3.8.4 - Cross-Site Request Forgery ↗
    2019-07-27 CVE-2019-14328 Cross-Site Request Forgery (CSRF) Affects < 3.8.5 Patched in 3.8.5
30. Medium · 6.1 Simple Membership <= 3.5.6 - Cross-Site Scripting ↗
    2017-11-08 CVE-2017-18499 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 3.5.7 Patched in 3.5.7
31. High · 8.8 Simple Membership <= 3.3.2 - Multiple Cross-Site Request Forgery ↗
    2016-09-16 CVE-2016-10884 Cross-Site Request Forgery (CSRF) Affects <= 3.3.2 Patched in 3.3.3
32. Medium · 6.1 Simple Membership < 3.2.9 - Reflected Cross-Site Scripting ↗
    2016-07-14 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 3.2.9 Patched in 3.2.9

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 52 languages, 3 at 90% or more

Plus 28 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2024-10-26 50K+ → 40K+ down after 1 days in tier
2. 2024-10-25 40K+ → 50K+ up after 1 days in tier
3. 2024-10-24 50K+ → 40K+ down after 2 days in tier
4. 2024-10-22 40K+ → 50K+ up after 1 days in tier
5. 2024-10-21 50K+ → 40K+ down after 1 days in tier
6. 2024-10-20 40K+ → 50K+ up after 2 days in tier
7. 2024-10-18 50K+ → 40K+ down after 1 days in tier
8. 2024-10-17 40K+ → 50K+ up after 1 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• S Simple Membership Menu 60+ installs · 3.9★ · 5 shared tags D
• S Simple Membership After Login Redirection 10K+ installs · 4.4★ · 3 shared tags A
• S Simple Membership Form Shortcode 2K+ installs · 4.1★ · 3 shared tags B
• My Members Only – Membership for WordPress 100+ installs · 4.0★ · 3 shared tags D
• Content Locker for Elementor 30+ installs · 3.6★ · 3 shared tags B
• M Membership Lock 10+ installs · 3.6★ · 3 shared tags D

Embed this report card

Drop a live Pulse card for Simple Membership into a readme, a review or a deck. It updates itself.

Simple Membership: 40K+ active installs, 4.6★ (475 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/simple-membership