The wp.insider Simple Membership plugin versions up to 4.6.3 suffer from a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw allows an attacker with high privileges and requiring user interaction to inject malicious scripts that can affect confidentiality, integrity, and availability to a limited extent. The vulnerability has a CVSS 3.1 base score of 5.9, reflecting medium severity with network attack vector, low attack complexity, and privileges required at a high level.

Successful exploitation could allow an attacker with high privileges to inject and execute malicious scripts in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. The vulnerability requires user interaction and high privileges, which limits the scope of exploitation. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and exercise caution with input handling in the affected plugin. Monitor for vendor updates regarding patches or mitigations.