# CVE-2026-42663: Simple Membership WordPress plugin XSS

Source: https://junglewise.ai/threats/cve-2026-42663-simple-membership-wordpress-plugin-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-42663 · Severity: medium · CVSS 6.5 · Published 2026-06-15

The Simple Membership plugin for WordPress, which manages member access and content protection, contains a security flaw that allows attackers to inject malicious scripts into the website. If a site administrator or visitor interacts with a specially crafted link or page, the attacker could redirect users to malicious sites, steal session information, or deface the website. This vulnerability can be used in automated campaigns to target a large number of websites simultaneously.

Technologies: [Simple Membership Team Simple Membership](https://junglewise.ai/threats/technologies/simple-membership). Vendors: [Simple Membership Team](https://junglewise.ai/threats/vendors/simple-membership-team).

## Quick answers

**Is CVE-2026-42663 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42663 being exploited in the wild.

**How severe is CVE-2026-42663?** Medium severity, with a CVSS score of 6.5, published 15 June 2026.

**Which products and versions are affected?** Simple Membership Team Simple Membership <= 4.7.2.

**Is there a fix for CVE-2026-42663?** A patch was published on 2026-05-03: Version 4.7.3 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42663 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42663?** Check whether you run Simple Membership Team Simple Membership at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the Simple Membership plugin for WordPress due to improper neutralization of input during web page generation (CWE-79). The flaw allows an unauthenticated attacker to inject arbitrary HTML or JavaScript payloads. While the vulnerability is classified as unauthenticated, successful exploitation requires user interaction, such as a privileged user clicking a malicious link or visiting a crafted page. This can lead to unauthorized actions in the context of the victim's browser, including session hijacking or site redirection. The issue is resolved in version 4.7.3.

## Affected products

- Simple Membership Team Simple Membership <= 4.7.2

## Timeline

- 2026-04-03: other: Vulnerability reported by researcher hhhai
- 2026-05-03: advisory: Patchstack published advisory details
- 2026-06-15: disclosed: CVE published to NVD
- 2026-05-03: patched: Version 4.7.3 released to address the vulnerability

## References

- [https://patchstack.com/database/wordpress/plugin/simple-membership/vulnerability/wordpress-simple-membership-plugin-4-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/simple-membership/vulnerability/wordpress-simple-membership-plugin-4-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [Simple Membership WordPress plugin stored XSS in Stripe webhook](https://junglewise.ai/threats/cve-2026-11855-simple-membership-wordpress-plugin-stored-xss-in-stripe-webhook)
- [Simple Membership broken access control in WordPress plugin](https://junglewise.ai/threats/cve-2026-34886-simple-membership-broken-access-control-in-wordpress-plugin)