CVE-2026-42663: Simple Membership WordPress plugin XSS

CVE-2026-42663 · Severity: medium · CVSS 6.5 · Published 2026-06-15

The Simple Membership plugin for WordPress, which manages member access and content protection, contains a security flaw that allows attackers to inject malicious scripts into the website. If a site administrator or visitor interacts with a specially crafted link or page, the attacker could redirect users to malicious sites, steal session information, or deface the website. This vulnerability can be used in automated campaigns to target a large number of websites simultaneously.

Technologies: Simple Membership Team Simple Membership. Vendors: Simple Membership Team.

Quick answers

Is CVE-2026-42663 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42663 being exploited in the wild.
How severe is CVE-2026-42663?
Medium severity, with a CVSS score of 6.5, published 15 June 2026.
Which products and versions are affected?
Simple Membership Team Simple Membership <= 4.7.2.
Is there a fix for CVE-2026-42663?
A patch was published on 2026-05-03: Version 4.7.3 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42663 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-42663?
Check whether you run Simple Membership Team Simple Membership at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the Simple Membership plugin for WordPress due to improper neutralization of input during web page generation (CWE-79). The flaw allows an unauthenticated attacker to inject arbitrary HTML or JavaScript payloads. While the vulnerability is classified as unauthenticated, successful exploitation requires user interaction, such as a privileged user clicking a malicious link or visiting a crafted page. This can lead to unauthorized actions in the context of the victim's browser, including session hijacking or site redirection. The issue is resolved in version 4.7.3.

Affected products

  • Simple Membership Team Simple Membership <= 4.7.2

Timeline

  • 2026-04-03: other: Vulnerability reported by researcher hhhai
  • 2026-05-03: advisory: Patchstack published advisory details
  • 2026-06-15: disclosed: CVE published to NVD
  • 2026-05-03: patched: Version 4.7.3 released to address the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.