The Simple Membership plugin by wp.insider suffers from a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This vulnerability affects all versions up to 4.6.3. Exploitation requires an attacker with high privileges and user interaction, and can lead to partial compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 vector indicates network-based attack with low complexity but requiring user interaction and elevated privileges. No official patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this stored XSS vulnerability can allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to unauthorized actions, data disclosure, or disruption of service. The impact affects confidentiality, integrity, and availability to a limited extent as per the CVSS vector. However, exploitation requires high privileges and user interaction, which limits the ease of attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and limit user interactions that could trigger stored XSS payloads. Monitor for updates from wp.insider regarding patches or mitigations for this vulnerability.