CVE-2026-11855

The Simple Membership WordPress plugin before 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escape a value taken from them before outputting it in an administrator notice, allowing unauthenticated attackers to inject arbitrary web scripts that execute in the context of a logged-in administrator.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.51% chance of exploitation in the next 30 days, 41th percentile

Published

2026-07-06

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/217cb606-a0f2-4427-9262-cfe1cc90474e/

References

• CVE Record
• NVD entry

Related

• CVE-2026-1184
• CVE-2026-11866
• CVE-2026-11834
• CVE-2026-11867
• CVE-2026-11827
• CVE-2026-11868