The WordPress Simple Membership plugin contains an unauthenticated Cross Site Scripting flaw that allows an attacker to inject and execute arbitrary JavaScript in the browsers of any visitor who views a page rendering the plugin’s output. The vulnerability is a classic client‑side XSS flaw that does not require any credentials and can be triggered by crafted URLs or form submissions containing malicious payloads. The weakness maps to CWE‑79, which highlights a failure to sanitize or encode user‑controlled data before rendering it to the browser.

WordPress sites that have installed any version of the Simple Membership plugin up to and including 4.7.2 are affected. The plugin is distributed by wp.insider and is active in sites that rely on it for general membership management. Any WordPress installation running these releases is potentially vulnerable.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score of less than 1 % suggests that widespread exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, meaning no publicly known exploits have been observed at scale. Nonetheless, because the flaw is unauthenticated, a malicious actor could only need to entice a site visitor to a crafted URL or a specially crafted form submission to trigger the XSS. Even a low probability of exploitation warrants mitigations, especially as XSS can be leveraged for phishing, credential theft, and other client‑side attacks.