CVE-2026-11855 is a CWE-79 Cross-Site Scripting vulnerability in the Simple Membership WordPress plugin. The vulnerability arises from the plugin's failure to verify Stripe webhook request authenticity when no signing secret is set, combined with improper output escaping of data from these requests in administrator notices. This flaw enables unauthenticated attackers to inject and execute arbitrary web scripts within the administrator's session context.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary JavaScript in the context of a logged-in administrator. This could lead to actions such as session hijacking, unauthorized administrative actions, or other malicious activities performed with administrator privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider configuring a Stripe signing secret to ensure webhook authenticity and avoid displaying untrusted data in administrator notices.