EUVD-2026-41820
GHSA-xmqj-cv3v-f292
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Stored/reflected cross-site scripting in the Simple Membership WordPress plugin before 4.7.5 lets unauthenticated attackers execute arbitrary JavaScript in a logged-in administrator's browser by abusing the Stripe webhook handler. When no Stripe signing secret is configured, the plugin fails to verify webhook authenticity and then renders an attacker-controlled value unescaped inside an admin notice. Publicly available exploit code exists (WPScan), though EPSS remains low at 0.18% and no active exploitation is reported (not in CISA KEV).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Simple Membership gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (WPScan) · only source for this CVE.
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Simple Membership WordPress plugin before 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escape a value taken from them before outputting it in an administrator notice, allowing unauthenticated attackers to inject arbitrary web scripts that execute in the context of a logged-in administrator.
Articles & Coverage 1
Executive ViewAI
Simple Membership WordPress plugin prior to version 4.7.5 contains a cross-site scripting flaw in its Stripe webhook handler that allows unauthenticated attackers to execute arbitrary code in administrator browsers; publicly available exploit code exists. This enables complete website takeover and credential compromise for organizations running affected plugin versions. Organizations using Simple Membership should apply the patch immediately to prevent unauthorized administrative access.
Within 24 hours, identify all WordPress deployments running Simple Membership and determine current plugin versions, with focus on production systems and those storing sensitive data. Within 7 days, update Simple Membership to version 4.7.5 or later across all affected instances after validating updates in non-production environments and preparing rollback procedures. Within 30 days, confirm patch deployment across all systems, enable alerts for future Simple Membership security updates, and verify that Stripe webhook signing secrets are properly configured to prevent unauthenticated webhook acceptance in the future.
Apply vendor patch: update Simple Membership plugin to version 4.7.5 or later. Interim mitigation: configure Stripe webhook signing secret in plugin settings to block unauthenticated webhook processing.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
More in Simple Membership
View allThe Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due
Account takeover of the primary WordPress administrator affects the Simple Membership plugin in all versions before 4.7.
The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editi
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section. Rated high severi
The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which
Stored cross-site scripting in the Simple Membership WordPress plugin before 4.7.8 allows unauthenticated attackers to i
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting t
Privilege escalation in the Simple Membership WordPress plugin before 4.7.8 allows authenticated members to obtain highe
Simple Membership, a WordPress membership plugin, transmits a newly registered member's plaintext password in a URL quer
The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could
Unauthenticated attackers can redirect activation and registration-complete emails to an arbitrary address in Simple Mem
Broken access control in the WordPress Simple Membership plugin (versions ≤4.7.1) allows remote unauthenticated attacker
Exploit-DB