XSS in Simple Membership
CVE-2026-15931
The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes in an administrator's session.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.002 (7.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Unknown Simple Membership — versions 0
Weakness classification (CWE)
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-15931?
- CVE-2026-15931 is a medium-severity vulnerability in Simple Membership, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-08-03.
- How severe is CVE-2026-15931?
- Medium severity. CVSS v3 base score is 6.1 out of 10.