WordPress security by component
Restrict Content
Plugin description
Restrict Content is a WordPress component with 10 published CVE records in this archive. The latest tracked vulnerability was published Mar 25, 2026; the highest CVE/CNA score is 8.2.
Plugin slug:
restrict-contentLatest vulnerability
CVE-2026-32546: Restrict Content: A security weakness
Restrict Content is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through <= 3.2.22.
| Safe version |
|
||
|---|---|---|---|
| Mar 25, 2026 |
CVE-2026-32546
Restrict Content: A security weakness
Restrict Content is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through <= 3.2.22.
|
3.2.23 |
CVE7.5
NVDPending
|
| Mar 20, 2026 |
CVE-2026-4136
Membership Plugin – Restrict Content: A security weakness
Membership Plugin – Restrict Content is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Mar 05, 2026 |
CVE-2026-1321
Membership Plugin – Restrict Content: Privilege escalation or authentication bypass
Membership Plugin – Restrict Content is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE8.1
NVDPending
|
| Feb 18, 2026 |
CVE-2026-1304
Restrict Content: Cross-site scripting
Restrict Content is affected by cross-site scripting. Exploitation requires at least administrator-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE4.4
NVDPending
|
| Jan 16, 2026 |
CVE-2025-14844
Membership Plugin – Restrict Content: A security weakness
Membership Plugin – Restrict Content is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE8.2
NVD7.5
|
| Dec 23, 2025 |
CVE-2025-14000
Membership Plugin – Restrict Content: Cross-site scripting
Membership Plugin – Restrict Content is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVDPending
|
| Jan 26, 2025 |
CVE-2024-11090
Membership Plugin – Restrict Content: Sensitive information exposure
Membership Plugin – Restrict Content is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.
|
See mitigation notes |
CVE5.3
NVD7.5
|
| Apr 15, 2024 |
CVE-2024-31432
Restrict Content: A security weakness
Restrict Content is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Nov 23, 2023 |
CVE-2023-47668
Restrict Content: A security weakness
Restrict Content is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVD7.5
|
| Jul 17, 2023 |
CVE-2023-3182
Membership: Cross-site scripting
Membership is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|