CVE-2026-11855

Name of the Vulnerable Software and Affected Versions Simple Membership WordPress plugin versions prior to 4.7.5

Description Insufficient verification of Stripe webhook requests occurs when no signing secret is configured. Additionally, the plugin fails to escape values retrieved from these requests before displaying them in administrator notices. This allows unauthenticated attackers to perform a Cross-Site Scripting (XSS) attack—injecting arbitrary web scripts that execute within the session of a logged-in administrator.

Recommendations Update Simple Membership WordPress plugin to version 4.7.5 or later.