The Simple Membership WordPress plugin before version 4.7.5 accepts Stripe webhook requests without checking a signing secret and then prints data from those requests in an administrator notice without escaping it. This flaw allows an unauthenticated attacker to inject JavaScript that runs in the context of any logged‑in administrator, potentially enabling phishing, credential theft, and further exploitation of the admin session.

This vulnerability affects all installations of the Simple Membership plugin for WordPress running any version earlier than 4.7.5. The flaw is present in every build where a Stripe webhook is enabled and no signing secret has been configured.

The CVSS score of 8.8 signals a high severity vulnerability, while the EPSS score of less than 1% indicates that exploitation is currently unlikely in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector likely involves an attacker crafting a malicious Stripe webhook payload and sending it to the plugin’s endpoint; because the plugin does not validate the request source, the script is stored and later executed when an administrator views the notice.