CVE-2024-1985

The Simple Membership plugin contains a stored cross-site scripting vulnerability in versions through 4.4.2 where the Display Name parameter lacks proper sanitization and escaping, allowing unauthenticated attackers to inject malicious scripts that execute when pages are accessed. Exploitation requires social engineering tactics to trick users into logging in with a compromised account containing the injected payload. The practical impact remains limited since the malicious code only runs when someone authenticates as the affected user account.

Based on public CVE data (MITRE/NVD).