CVE-2026-103427: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wpinsider-1 Simple Membership

CVE-2026-103427 describes a stored Cross-Site Scripting vulnerability in the Simple Membership WordPress plugin (versions up to and including 4.8.4). The vulnerability arises from insufficient input sanitization and output escaping of the 'country' parameter, enabling attackers with subscriber-level privileges or higher to inject arbitrary web scripts. When the Enable Free Membership feature is active, unauthenticated attackers can also exploit this flaw by submitting malicious input via anonymous registration and profile submission. The vulnerability has a CVSS 3.1 base score of 6.4, indicating a medium severity level.

Successful exploitation allows attackers to execute arbitrary scripts in the context of the affected site, potentially leading to session hijacking, defacement, or other malicious actions impacting confidentiality and integrity. The vulnerability affects both authenticated users with subscriber-level access and, under certain configuration (Enable Free Membership enabled), unauthenticated users.

No official patch or fix is currently documented for this vulnerability. Users should check the vendor's advisory for updates. Until a fix is available, consider disabling the Enable Free Membership feature to prevent unauthenticated exploitation and restrict user input where possible.