8.8
Élevée
CVE-2026-11855 The Simple Membership WordPress plugin before 4.7.5 does not verify the authenticity of Stripe webhook requests when…
Description
The Simple Membership WordPress plugin before 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escape a value taken from them before outputting it in an administrator notice, allowing unauthenticated attackers to inject arbitrary web scripts that execute in the context of a logged-in administrator.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Simple Membership 4.7 | premières → < 4.7.5 | 4.7.5 |
Références
- wpscan.com wpscan.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Simple Membership
Les 12 CVE de Simple Membership →
CVE-2026-88785
The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext…
4.7
Moyenne
CVE-2026-88764
The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal…
5.4
Moyenne
CVE-2026-14936
The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the…
5.3
Moyenne
CVE-2026-15931
The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an…
6.1
Moyenne