Threats tagged 'ghsa-cc2x-fmqx-2g5v'

A Cross-Site Scripting (XSS) vulnerability exists in the Simple Membership WordPress plugin before version 4.7.8. The plugin fails to sanitize a subscriber name value received from an unauthenticated payment approval request and does not escape it when displaying in the admin dashboard. This allows unauthenticated attackers to inject and store arbitrary JavaScript that executes in an administrator's session, potentially leading to session hijacking or other malicious actions.