# CVE-2026-11855: Simple Membership WordPress plugin stored XSS in Stripe webhook

Source: https://junglewise.ai/threats/cve-2026-11855-simple-membership-wordpress-plugin-stored-xss-in-stripe-webhook  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-11855 · Severity: info · CVSS 8.8 · Published 2026-07-06

The Simple Membership plugin for WordPress, which manages member subscriptions and payments, contains a security flaw in how it handles payment notifications from Stripe. An attacker can send a fake notification that injects malicious code into the website's management dashboard. If a site administrator views their dashboard, this code could allow the attacker to take control of the website or steal sensitive administrative information.

Technologies: [Simple Membership Team Simple Membership](https://junglewise.ai/threats/technologies/simple-membership). Vendors: [Simple Membership Team](https://junglewise.ai/threats/vendors/simple-membership-team).

## Quick answers

**Is CVE-2026-11855 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11855 being exploited in the wild.

**How severe is CVE-2026-11855?** Informational severity, with a CVSS score of 8.8, published 6 July 2026.

**Which products and versions are affected?** Simple Membership Team Simple Membership < 4.7.5.

**Is there a fix for CVE-2026-11855?** A patch was published on 2026-07-06: Fixed in version 4.7.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-11855 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11855?** Check whether you run Simple Membership Team Simple Membership at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in the Simple Membership plugin due to insufficient validation of Stripe webhook requests. When a Stripe signing secret is not configured (the default state), the plugin processes unauthenticated POST requests to the 'swpm_process_stripe_subscription' endpoint. An attacker can provide a malicious payload in the 'api_version' field of the JSON body. If the version string is prefixed with an older date, the plugin stores the value in the 'swpm_stripe_received_api_old_version' option and subsequently renders it unescaped within a WordPress admin notice. This allows for arbitrary JavaScript execution in the context of a logged-in administrator. The issue is fixed in version 4.7.5.

## Affected products

- Simple Membership Team Simple Membership < 4.7.5

## Timeline

- 2026-06-15: disclosed: Publicly published by WPScan
- 2026-07-06: advisory: NVD publication date
- 2026-07-06: patched: Fixed in version 4.7.5

## References

- [https://wpscan.com/vulnerability/217cb606-a0f2-4427-9262-cfe1cc90474e/](https://wpscan.com/vulnerability/217cb606-a0f2-4427-9262-cfe1cc90474e/)

## Related threats

- [Simple Membership WordPress plugin XSS](https://junglewise.ai/threats/cve-2026-42663-simple-membership-wordpress-plugin-xss)
- [Simple Membership broken access control in WordPress plugin](https://junglewise.ai/threats/cve-2026-34886-simple-membership-broken-access-control-in-wordpress-plugin)