CVE-2026-15931

The CVE concerns the WordPress plugin Simple Membership (pre-4.7.8). The issue arises because a subscriber name value coming from an unauthenticated payment approval is not sanitized and is not escaped when shown in the admin dashboard, enabling an unauthenticated attacker to store arbitrary Java...