The Simple Membership WordPress plugin before version 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escape a value taken from them before outputting it in an administrator notice. This flaw allows an unauthenticated attacker to inject arbitrary JavaScript that runs in the context of any logged‑in administrator, potentially enabling phishing, credential theft, tampering with site content, or further exploitation of the administrator’s session.

This vulnerability affects the Simple Membership plugin for WordPress, specifically any installation running a version earlier than 4.7.5. The issue is present in all builds of the plugin where a Stripe webhook is enabled without configuring a signing secret.

The CVSS score of 8.8 indicates a high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker sending a crafted webhook payload to the plugin’s endpoint; because the plugin does not validate the source, the payload is accepted and the malicious script is stored and later executed when an administrator views the notice. Mitigation requires updating the plugin or protecting the endpoint with a signing secret to ensure only authenticated requests are processed.