Skip to content
fr Sign in
8.8 High

CVE-2026-11855 The Simple Membership WordPress plugin before 4.7.5 does not verify the authenticity of Stripe webhook requests when…

Description

The Simple Membership WordPress plugin before 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escape a value taken from them before outputting it in an administrator notice, allowing unauthenticated attackers to inject arbitrary web scripts that execute in the context of a logged-in administrator.

Affected products and versions

Product Affected versions Fixed in
Simple Membership 4.7 earliest → < 4.7.5 4.7.5

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Simple Membership

The 12 CVEs of Simple Membership →
CVE-2026-88785 The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext… 4.7 Medium CVE-2026-88764 The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal… 5.4 Medium CVE-2026-14936 The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the… 5.3 Medium CVE-2026-15931 The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an… 6.1 Medium
Track this CVE