PatchSiren cyber security CVE debrief
CVE-2026-42663 wp.insider CVE debrief
CVE-2026-42663 is a MEDIUM severity Unauthenticated Cross Site Scripting (XSS) vulnerability in Simple Membership plugin versions <= 4.7.2. The vulnerability was published on [cvePublishedAt] and last modified on [cveModifiedAt]. The CVSS score for this vulnerability is 6.5.
- Vendor
- wp.insider
- Product
- Simple Membership
- CVSS
- MEDIUM 6.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-15
- Original CVE updated
- 2026-06-15
- Advisory published
- 2026-06-15
- Advisory updated
- 2026-06-15
Who should care
Users of Simple Membership plugin versions <= 4.7.2 should be aware of this vulnerability and take necessary actions to mitigate it.
Technical summary
The vulnerability is an Unauthenticated Cross Site Scripting (XSS) in Simple Membership plugin versions <= 4.7.2. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L.
Defensive priority
MEDIUM
Recommended defensive actions
- Update Simple Membership plugin to a version greater than 4.7.2.
- Refer to [ref-4] for mitigation or vendor reference.
Evidence notes
The vulnerability was reported by Patchstack.
Official resources
-
CVE-2026-42663 CVE record
CVE.org
-
CVE-2026-42663 NVD detail
NVD
-
Source item URL
nvd_modified
- Mitigation or vendor reference
CVE-2026-42663 was published on 2026-06-15T21:16:56.053Z and last modified on 2026-06-15T21:24:32.790Z.