EUVD-2026-52176
GHSA-cc2x-fmqx-2g5v
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AV:N unauthenticated network injection; PR:N no auth needed for submission; UI:R admin must view dashboard; S:C XSS crosses to admin origin; no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes in an administrator's session.
AnalysisAI
Stored cross-site scripting in the Simple Membership WordPress plugin before 4.7.8 allows unauthenticated attackers to inject arbitrary JavaScript into the WordPress administration dashboard by supplying a malicious subscriber name in a payment approval request. Because the plugin neither sanitizes the input at ingestion nor escapes it on output when rendered for administrators, the payload persists server-side and executes in any administrator's browser session upon viewing the affected dashboard panel. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The WordPress site must have the Simple Membership plugin installed, active, and configured with payment processing functionality that accepts external payment approval or notification requests - the vulnerable input path is the unauthenticated payment approval endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS base score of 6.1 (Medium) is driven by network reachability, no authentication required for injection, and a scope change to the admin session, but is tempered by the required user interaction (UI:R) and partial C/I impacts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a crafted payment approval request to the Simple Membership plugin endpoint, supplying a subscriber name containing a JavaScript payload such as a cookie-stealing script - no authentication is required at this stage. The payload is stored in the WordPress database as-is. … |
| Remediation | Update the Simple Membership plugin to version 4.7.8 or later immediately; this is the vendor-released patch that addresses both the missing input sanitization on the payment approval endpoint and the missing output escaping in the administration dashboard. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Simple Membership
View allThe Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due
Account takeover of the primary WordPress administrator affects the Simple Membership plugin in all versions before 4.7.
Stored/reflected cross-site scripting in the Simple Membership WordPress plugin before 4.7.5 lets unauthenticated attack
The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editi
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section. Rated high severi
The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting t
The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could
Remote attackers without any authentication can bypass authorization checks in the Simple Membership WordPress plugin (v
Broken access control in the WordPress Simple Membership plugin (versions ≤4.7.1) allows remote unauthenticated attacker
The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in
The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `list_type` parameter
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today