CVE-2026-15931 — MEDIUM (6.1)

Vulnerability Description

The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes in an administrator's session.

CVSS Score

6.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Related Weaknesses (CWE)

CWE-79

References

https://wpscan.com/vulnerability/30779ecc-779c-4e7c-9e8b-278ddf343214/

FAQ

What is CVE-2026-15931?

CVE-2026-15931 is a vulnerability with a CVSS score of 6.1 (MEDIUM). The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the adminis...

How severe is CVE-2026-15931?

CVE-2026-15931 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-15931?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.