Simple Membership EUVD-2026-96206

By default, exploitation requires an authenticated account with subscriber-level access or above (PR:L) and the ability to submit the member profile form containing the 'country' field. The vulnerability becomes exploitable by fully unauthenticated attackers ONLY when the plugin's 'Enable Free Membership' feature is enabled, since that permits anonymous front-end registration and profile submission. Payload execution additionally requires that another user subsequently load the page rendering the stored 'country' value (e.g., an admin reviewing members), making victim page-view a practical limiting factor. Affected deployments are limited to WordPress sites running Simple Membership version 4.8.4 or earlier; upgrading to 4.8.5 removes the condition.

This is a stored XSS (CWE-79) in the Simple Membership WordPress plugin rated CVSS 6.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The network vector, low complexity, and scope change (S:C) reflect a typical persistent XSS where injected script executes in other users'/admins' browser contexts. No EPSS score, KEV listing, or public POC was provided, so exploitation status is 'no public exploit identified at time of analysis' - this is a credible but not confirmed-exploited issue. The most important risk nuance is the PR qualifier: by default exploitation requires at least subscriber-level authentication (PR:L), which limits mass exploitation; however, the description explicitly states that if the 'Enable Free Membership' feature is enabled, unauthenticated attackers can register and submit a profile anonymously, effectively lowering the barrier to PR:N in that configuration - the published CVSS vector does NOT reflect this worse-case path, so defenders running free membership should treat it as more severe than 6.4 suggests. Overall this is a real but moderate-priority issue: patch promptly, prioritize sites with open/free registration, but it is not a drop-everything critical given Low confidentiality/integrity impact, no availability impact, and no evidence of active exploitation.

An attacker registers a subscriber account (or, if 'Enable Free Membership' is on, registers anonymously from the front end) and submits a membership profile with a malicious script payload in the 'country' field. Because input is neither sanitized on entry nor escaped on output, the stored script executes whenever another user - including an administrator reviewing members - views the injected page, enabling session/credential theft or admin-context actions. No public exploit code was identified, and successful execution depends on a victim rendering the affected page.