--- title: "StellarWP Membership Plugin – Restrict Content vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/stellarwp/membership-plugin-restrict-content type: product description: "StellarWP Membership Plugin – Restrict Content has 7 published CVEs, 0 in CISA KEV and 0 with public exploits." updated: 2026-03-20 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # StellarWP Membership Plugin – Restrict Content vulnerabilities Vendor: [StellarWP](https://radicalnotion.ai/vendor/stellarwp) - **Published CVEs:** 7 - **In CISA KEV:** 0 - **With a public exploit:** 0 - **With a patch:** 7 - **Average CVSS:** 6.6 - **First CVE:** 2023-11-23 - **Latest CVE:** 2026-03-20 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 0 | | High | 4 | | Medium | 3 | | Low | 0 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-200](https://radicalnotion.ai/cwe/cwe-200) | Exposure of Sensitive Information to an Unauthorized Actor | 2 | | [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 2 | | [CWE-639](https://radicalnotion.ai/cwe/cwe-639) | Authorization Bypass Through User-Controlled Key | 1 | | [CWE-640](https://radicalnotion.ai/cwe/cwe-640) | Weak Password Recovery Mechanism for Forgotten Password | 1 | | [CWE-862](https://radicalnotion.ai/cwe/cwe-862) | Missing Authorization | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2023 | 1 | | 2024 | 0 | | 2025 | 2 | | 2026 | 4 | ## Affected versions | Version | Kind | CVEs | | --- | --- | --- | | \<= 3.2.13 | range | 1 | | \<= 3.2.15 | range | 1 | | \<= 3.2.16 | range | 1 | | \<= 3.2.18 | range | 1 | | \<= 3.2.20 | range | 1 | | \<= 3.2.24 | range | 1 | | \<= 3.2.7 | range | 1 | | \>= 3.2.8 | range | 1 | | 3.2.8 | patched | 1 | ## CVEs | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-4136 | Membership Plugin – Restrict Content \<= 3.2.24 - Unvalidated Redirect in Password Reset Flow via rcp\_redirect | medium | 4.3 | No | No | Yes | | CVE-2026-1321 | Membership Plugin – Restrict Content \<= 3.2.20 - Unauthenticated Privilege Escalation via 'rcp\_level' | high | 8.1 | No | No | Yes | | CVE-2026-1304 | Membership Plugin – Restrict Content \<= 3.2.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice Settings | medium | 4.4 | No | No | Yes | | CVE-2025-14844 | Membership Plugin – Restrict Content \<= 3.2.16 - Missing Authentication to Insecure Direct Object Reference and Sensitive Information Exposure | high | 8.2 | No | No | Yes | | CVE-2025-14000 | Membership Plugin – Restrict Content \<= 3.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes | medium | 6.4 | No | No | Yes | | CVE-2024-11090 | Membership Plugin – Restrict Content \<= 3.2.13 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure | high | 7.5 | No | No | Yes | | CVE-2023-47668 | WordPress Restrict Content Plugin \<= 3.2.7 is vulnerable to Sensitive Data Exposure | high | 7.5 | No | No | Yes | ## Frequently asked questions ### How many CVEs does StellarWP Membership Plugin – Restrict Content have? StellarWP Membership Plugin – Restrict Content has 7 published CVE records since 2023. ### How many StellarWP Membership Plugin – Restrict Content CVEs are in CISA KEV? None of StellarWP Membership Plugin – Restrict Content's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Are there public exploits for StellarWP Membership Plugin – Restrict Content vulnerabilities? No StellarWP Membership Plugin – Restrict Content CVEs currently have a tracked public exploit in this dataset. ### Which versions of StellarWP Membership Plugin – Restrict Content are affected? 9 distinct StellarWP Membership Plugin – Restrict Content versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in StellarWP Membership Plugin – Restrict Content CVEs? StellarWP Membership Plugin – Restrict Content's CVEs most often map to these CWE weakness types: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-639 (Authorization Bypass Through User-Controlled Key), CWE-640 (Weak Password Recovery Mechanism for Forgotten Password). ### What is the average severity of StellarWP Membership Plugin – Restrict Content CVEs? The average CVSS base score across StellarWP Membership Plugin – Restrict Content's scored CVEs is 6.6. ## Other products from this vendor - [GiveWP – Donation Plugin and Fundraising Platform](https://radicalnotion.ai/vendor/stellarwp/givewp-donation-plugin-and-fundraising-platform) (34 CVEs) - [Kadence Blocks — Page Builder Toolkit for Gutenberg Editor](https://radicalnotion.ai/vendor/stellarwp/kadence-blocks-page-builder-toolkit-for-gutenberg-editor) (30 CVEs) - [The Events Calendar](https://radicalnotion.ai/vendor/stellarwp/the-events-calendar) (26 CVEs) - [Event Tickets and Registration](https://radicalnotion.ai/vendor/stellarwp/event-tickets-and-registration) (8 CVEs) - [GiveWP](https://radicalnotion.ai/vendor/stellarwp/givewp) (8 CVEs) - [LearnDash LMS](https://radicalnotion.ai/vendor/stellarwp/learndash-lms) (7 CVEs) - [WPComplete](https://radicalnotion.ai/vendor/stellarwp/wpcomplete) (4 CVEs) - [Bookit — Booking & Appointment Calendar](https://radicalnotion.ai/vendor/stellarwp/bookit-booking-and-appointment-calendar) (3 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/stellarwp/membership-plugin-restrict-content). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.