CVE-2026-15931 is a CWE-79 Cross-Site Scripting vulnerability in the Simple Membership WordPress plugin versions prior to 4.7.8. The flaw arises because the plugin does not sanitize subscriber name input from unauthenticated payment approval requests, nor does it escape this data when rendering it in the administration dashboard. Consequently, attackers can store malicious JavaScript that executes in the context of an administrator's browser session upon viewing the dashboard.

An unauthenticated attacker can inject persistent JavaScript code that executes in an administrator's session when they view the affected dashboard page. This can lead to session hijacking, unauthorized actions performed with administrator privileges, or other attacks leveraging the administrator's elevated rights. The confidentiality and integrity of the administrator's session and potentially the entire site are at risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when reviewing payment approval requests and consider restricting access to the dashboard or implementing additional input validation and output escaping controls as temporary mitigations.