CVE-2026-15931
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Simple Membership WordPress plugin before version 4.7.8 does not sanitize a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard. This allows unauthenticated attackers to store arbitrary JavaScript that executes in an administrator's session.
Risk Assessment
An attacker can hijack an administrator's session, leading to full site compromise, including data theft and content modification.
Recommendation
Update the Simple Membership plugin to version 4.7.8 or later, which includes proper sanitization and escaping.
Other vulnerabilities in Simple Membership
See all- CVE-2026-15930Critical
The Simple Membership WordPress plugin before version 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account. This allows unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.
- CVE-2026-14936Medium
The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership. This allows unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.
- CVE-2026-66712High
Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.
- CVE-2026-11855High
The Simple Membership WordPress plugin before version 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escapes a value taken from them before outputting it in an administrator notice, allowing unauthenticated attackers to inject arbitrary web scripts that execute in the context of a logged-in administrator.
- CVE-2026-42663Medium
There is an unauthenticated Cross Site Scripting (XSS) vulnerability in Simple Membership versions <= 4.7.2. An attacker can exploit this flaw to inject malicious scripts.
- CVE-2026-34886High
Simple Membership versions up to 4.7.1 have a vulnerability in access control that allows unauthorized access.
Original NVD description (English source)
The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes in an administrator's session.