CVE-2026-11855: Simple Membership WordPress plugin stored XSS in Stripe webhook

CVE-2026-11855 · Severity: info · CVSS 8.8 · Published 2026-07-06

The Simple Membership plugin for WordPress, which manages member subscriptions and payments, contains a security flaw in how it handles payment notifications from Stripe. An attacker can send a fake notification that injects malicious code into the website's management dashboard. If a site administrator views their dashboard, this code could allow the attacker to take control of the website or steal sensitive administrative information.

Technologies: Simple Membership Team Simple Membership. Vendors: Simple Membership Team.

Quick answers

Is CVE-2026-11855 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-11855 being exploited in the wild.
How severe is CVE-2026-11855?
Informational severity, with a CVSS score of 8.8, published 6 July 2026.
Which products and versions are affected?
Simple Membership Team Simple Membership < 4.7.5.
Is there a fix for CVE-2026-11855?
A patch was published on 2026-07-06: Fixed in version 4.7.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11855 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-11855?
Check whether you run Simple Membership Team Simple Membership at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in the Simple Membership plugin due to insufficient validation of Stripe webhook requests. When a Stripe signing secret is not configured (the default state), the plugin processes unauthenticated POST requests to the 'swpm_process_stripe_subscription' endpoint. An attacker can provide a malicious payload in the 'api_version' field of the JSON body. If the version string is prefixed with an older date, the plugin stores the value in the 'swpm_stripe_received_api_old_version' option and subsequently renders it unescaped within a WordPress admin notice. This allows for arbitrary JavaScript execution in the context of a logged-in administrator. The issue is fixed in version 4.7.5.

Affected products

  • Simple Membership Team Simple Membership < 4.7.5

Timeline

  • 2026-06-15: disclosed: Publicly published by WPScan
  • 2026-07-06: advisory: NVD publication date
  • 2026-07-06: patched: Fixed in version 4.7.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.