Executive brief
The Simple Membership plugin for WordPress, which manages member access and content protection, contains a security flaw that allows attackers to inject malicious scripts into the website. If a site administrator or visitor interacts with a specially crafted link or page, the attacker could redirect users to malicious sites, steal session information, or deface the website. This vulnerability can be used in automated campaigns to target a large number of websites simultaneously.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the Simple Membership plugin for WordPress due to improper neutralization of input during web page generation (CWE-79). The flaw allows an unauthenticated attacker to inject arbitrary HTML or JavaScript payloads. While the vulnerability is classified as unauthenticated, successful exploitation requires user interaction, such as a privileged user clicking a malicious link or visiting a crafted page. This can lead to unauthorized actions in the context of the victim's browser, including session hijacking or site redirection. The issue is resolved in version 4.7.3.
Affected products
- Simple Membership Team Simple Membership <= 4.7.2
Timeline
- 2026-04-03: other: Vulnerability reported by researcher hhhai
- 2026-05-03: advisory: Patchstack published advisory details
- 2026-06-15: disclosed: CVE published to NVD
- 2026-05-03: patched: Version 4.7.3 released to address the vulnerability