PT-2026-55866 · WordPress · Simple Membership

Duy Tran · Published 2026-07-06 · Updated 2026-07-06 · CVE-2026-11855

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Simple Membership WordPress plugin versions prior to 4.7.5

Description Insufficient verification of Stripe webhook requests occurs when no signing secret is configured. Additionally, the plugin fails to escape values retrieved from these requests before displaying them in administrator notices. This allows unauthenticated attackers to perform a Cross-Site Scripting (XSS) attack—injecting arbitrary web scripts that execute within the session of a logged-in administrator.

Recommendations Update Simple Membership WordPress plugin to version 4.7.5 or later.

Exploit

Fix

Related Identifiers

CVE-2026-11855

Affected Products

Simple Membership

References · 2

• 🔥 https://wpscan.com/vulnerability/217cb606-a0f2-4427-9262-cfe1cc90474e · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-11855 · Security Note