Simple Membership CVE-2026-15931

The WordPress site must have the Simple Membership plugin installed, active, and configured with payment processing functionality that accepts external payment approval or notification requests - the vulnerable input path is the unauthenticated payment approval endpoint. No subscriber account or authentication is required for the injection step. Exploitation of the XSS payload requires a WordPress administrator to subsequently visit the admin dashboard page that renders the subscriber name field. Limiting factors include: the required admin user interaction (UI:R in CVSS) meaning the attacker cannot trigger payload execution on demand; payment functionality must be enabled (not all Simple Membership deployments use payments); and the attack is rated non-automatable by SSVC, meaning scripted mass exploitation at scale is not straightforward.

The NVD CVSS base score of 6.1 (Medium) is driven by network reachability, no authentication required for injection, and a scope change to the admin session, but is tempered by the required user interaction (UI:R) and partial C/I impacts. EPSS at 0.17% (7th percentile) suggests the vulnerability is not currently seeing broad opportunistic exploitation, consistent with the SSVC assessment of 'poc' exploitation status and 'not automatable' - the attack chain depends on an administrator organically visiting the dashboard after the payload is planted, ruling out fully automated mass exploitation. No CISA KEV listing was identified at time of analysis. However, the existence of a public proof-of-concept (sourced from WPScan) meaningfully lowers the skill threshold for exploitation, and stored XSS payloads in admin dashboards are a well-understood path to full WordPress site compromise (credential theft, plugin installation, privilege escalation). The gap between the low EPSS and the real-world leverage available upon successful admin session hijacking means defenders should not treat the Medium CVSS score as license to deprioritize patching.

An attacker submits a crafted payment approval request to the Simple Membership plugin endpoint, supplying a subscriber name containing a JavaScript payload such as a cookie-stealing script - no authentication is required at this stage. The payload is stored in the WordPress database as-is. When a site administrator next logs into the WordPress admin panel and navigates to the membership or payment dashboard view, the stored script executes in their browser session, potentially exfiltrating the administrator's session cookie or nonce tokens to an attacker-controlled server. A public proof-of-concept demonstrating this injection path is available via WPScan.