CVE-2026-15931 is a stored cross-site scripting vulnerability in the Simple Membership WordPress plugin prior to version 4.7.8. The vulnerability arises because the plugin does not sanitize subscriber name input received via unauthenticated payment approval requests, nor does it escape this data when rendering it in the admin dashboard. As a result, an attacker can inject malicious JavaScript that executes in the context of an administrator's browser session, potentially leading to session hijacking or other administrative actions.

An unauthenticated attacker can inject arbitrary JavaScript code that executes in the context of an administrator's session when viewing the administration dashboard. This can lead to administrative account compromise or other malicious actions performed with administrator privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the administration dashboard and monitor for suspicious activity. Avoid processing untrusted payment approval requests or sanitize inputs manually if possible.