The vulnerability arises because Simple Membership WordPress plugin versions prior to 4.7.8 do not sanitize a subscriber name value obtained from a PayPal payment approval request, nor escape it when rendering that value in the administration dashboard. As a result, unauthenticated attackers can inject arbitrary JavaScript into the subscriber name field and have that code executed in an administrator's browser session. The weakness corresponds to improper neutralization of input during web page generation (CWE-79).

The affected product is the Simple Membership plugin for WordPress, with all releases before version 4.7.8 considered vulnerable. The vendor is listed as Unknown:Simple Membership.

The vulnerability can be exploited without authentication by sending a crafted payment approval request that includes malicious JavaScript in the subscriber name field. Because the endpoint handling the request is publicly reachable, an attacker can store the payload and have it executed whenever an administrator views subscription data. The CVSS score of 6.1 with an EPSS score of < 1% indicates a moderate severity but low likelihood of exploitation. No KEV listing exists, yet the ability to run arbitrary code in an admin’s browser session remains a serious concern.