CVE-2026-11855: Simple Membership < 4.7.5 - Unauthenticated Stored XSS via Stripe Webhook API Version
The Simple Membership WordPress plugin before 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escape a value taken from them before outputting it in an administrator notice, allowing unauthenticated attackers to inject arbitrary web scripts that execute in the context of a logged-in administrator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/simple-membershipto a version that resolves this vulnerability.Fixed in 4.7.5 - Configuration
Configure a Stripe signing secret so the plugin verifies the authenticity of Stripe webhook requests (the issue occurs when no signing secret is configured).
Simple Membership (WordPress plugin) Stripe webhook signing secret configuration = configured - Compensating control
If you cannot immediately upgrade, restrict or otherwise limit access to any endpoints used for Stripe webhooks so unauthenticated attackers cannot send arbitrary webhook payloads.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11855?
CVE-2026-11855 has a high severity rating of 8.8.
How can I fix CVE-2026-11855?
To fix CVE-2026-11855, update the Simple Membership plugin to version 4.7.5 or later.
What type of vulnerability is CVE-2026-11855?
CVE-2026-11855 is classified as an unauthenticated stored Cross-Site Scripting (XSS) vulnerability.
What impact does CVE-2026-11855 have on my WordPress site?
CVE-2026-11855 allows unauthenticated attackers to inject arbitrary web scripts, posing significant security risks to your WordPress site.
Is the Stripe Webhook API vulnerable in CVE-2026-11855?
Yes, CVE-2026-11855 indicates that the Stripe Webhook API is vulnerable due to lack of authenticity verification when no signing secret is configured.