CVE-2026-15931
Received Received - Intake

Stored XSS in Simple Membership WordPress Plugin

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: WPScan

Description
The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes in an administrator's session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-23
AI Q&A
2026-08-03
EPSS Evaluated
2026-08-22
NVD
CVE-2026-15931
EUVD
EUVD-2026-52176

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
simple_membership plugin to 4.7.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the Simple Membership WordPress plugin before version 4.7.8. It allows unauthenticated attackers to inject arbitrary JavaScript code by exploiting an unsanitized subscriber name value from an unauthenticated payment approval request. The injected script executes when an administrator views the dashboard.

Detection Guidance

Check if the Simple Membership WordPress plugin version is below 4.7.8. Inspect subscriber names in the admin dashboard for unexpected JavaScript code. Look for unauthenticated payment approval requests with malicious payloads in server logs.

Impact Analysis

If exploited, this vulnerability allows attackers to perform actions on behalf of administrators, steal session cookies, or take over the WordPress site. It compromises the integrity of the site and the security of user data.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and security. It may result in legal penalties, loss of trust, and compliance violations.

Mitigation Strategies

Update the Simple Membership plugin to version 4.7.8 or higher immediately. Review and remove any suspicious subscriber names containing JavaScript code. Monitor admin dashboard sessions for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15931. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart