CVE-2026-103427

Name of the Vulnerable Software and Affected Versions Simple Membership versions prior to 4.8.5

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into pages that execute when accessed by other users. Additionally, unauthenticated attackers can exploit this issue if the Enable Free Membership feature is active, as it allows anonymous front-end registration and profile submission via the country parameter.

Recommendations Update Simple Membership to version 4.8.5 or later. Restrict the use of the country parameter or disable the Enable Free Membership feature as a temporary mitigation measure.