CyberRota Analysis
AI-GeneratedThe Simple Membership WordPress plugin prior to version 4.7.8 is vulnerable due to improper sanitization of subscriber name values from unauthenticated payment approval requests. This flaw allows attackers to inject arbitrary JavaScript that can execute within an administrator's session, potentially leading to unauthorized actions or data exposure. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes in an administrator's session.