EUVD-2026-41820
GHSA-xmqj-cv3v-f292
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (WPScan) · only source for this CVE.
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Simple Membership WordPress plugin before 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escape a value taken from them before outputting it in an administrator notice, allowing unauthenticated attackers to inject arbitrary web scripts that execute in the context of a logged-in administrator.
Articles & Coverage 1
AnalysisAI
Stored/reflected cross-site scripting in the Simple Membership WordPress plugin before 4.7.5 lets unauthenticated attackers execute arbitrary JavaScript in a logged-in administrator's browser by abusing the Stripe webhook handler. When no Stripe signing secret is configured, the plugin fails to verify webhook authenticity and then renders an attacker-controlled value unescaped inside an admin notice. Publicly available exploit code exists (WPScan), though EPSS remains low at 0.18% and no active exploitation is reported (not in CISA KEV).
More in Simple Membership
View allThe Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due
Account takeover of the primary WordPress administrator affects the Simple Membership plugin in all versions before 4.7.
The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editi
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section. Rated high severi
The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which
Stored cross-site scripting in the Simple Membership WordPress plugin before 4.7.8 allows unauthenticated attackers to i
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting t
Privilege escalation in the Simple Membership WordPress plugin before 4.7.8 allows authenticated members to obtain highe
The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could
Remote attackers without any authentication can bypass authorization checks in the Simple Membership WordPress plugin (v
Broken access control in the WordPress Simple Membership plugin (versions ≤4.7.1) allows remote unauthenticated attacker
The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today