CVE-2026-11855 is a cross-site scripting (CWE-79) vulnerability in the Simple Membership WordPress plugin prior to version 4.7.5. The vulnerability arises from the plugin's failure to verify Stripe webhook request authenticity when no signing secret is set and the lack of proper output escaping of data derived from these requests. As a result, unauthenticated attackers can inject malicious scripts that execute with administrator privileges, potentially compromising confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a logged-in administrator. This can lead to full compromise of the administrator's session, data theft, or further system compromise. The vulnerability affects confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 4.7.5, upgrading to version 4.7.5 or later is implied as a remediation step. Until an official fix is confirmed, administrators should ensure Stripe webhook signing secrets are configured to prevent unauthenticated requests. Monitor vendor channels for an official patch or update.