Vulnerability · Published Aug 3, 2026 · Assigned by WPScan
CVE-2026-15931Simple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name
Medium 6.1
In plain English
A medium-severity cross-site scripting in Simple Membership from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.3%top 80.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes in an administrator's session.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Simple Membership | 0 – before 4.7.8 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://wpscan.com/vulnerability/30779ecc-779c-4e7c-9e8b-278ddf343214/ exploit, vdb-entry, technical-description