CVE-2026-42663 is a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability in the Simple Membership plugin by wp.insider. It allows unauthenticated attackers to perform cross-site scripting (XSS) attacks on versions up to 4.7.2. The vulnerability arises from insufficient sanitization of input data before rendering it on web pages, enabling injection of malicious scripts. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and a scope change with low impact on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected web application, potentially allowing attackers to steal user data, hijack sessions, or perform actions on behalf of users. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any available workarounds or temporary mitigations recommended by the vendor or security community. Avoid exposing vulnerable versions to untrusted users and monitor for updates from wp.insider regarding patches.