Simple Membership payment approvals let visitors store administrator XSS
Simple Membership before 4.7.8 accepts a subscriber-name value from an unauthenticated payment-approval request, stores it without sanitization and renders it unescaped in the administration dashboard. An unauthenticated attacker can submit script-bearing subscriber data that executes when an Administrator views the affected record.
- Component
- Simple Membership
- Plugin slug
simple-membership- Affected
- < 4.7.8
- Safe version
4.7.8- Published
- Aug 03, 2026
This CVE was published Aug 03, 2026 and is one of 34 known issues for this plugin.
Update, patch or deactivate.
Update Simple Membership to 4.7.8 or later. Review subscriber names created through payment approvals, remove scripts or event handlers and invalidate privileged sessions if an Administrator viewed affected records.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes in an administrator's session.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N