CVE-2025-62023
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
Improper Control of Generation of Code ('Code Injection') vulnerability in Cristián Lávaque s2Member s2member. This issue affects s2Member: from n/a through 250905.
Risk Assessment
An attacker can inject and execute arbitrary code within the WordPress context, potentially leading to site takeover and compromise of user data.
Recommendation
Update the s2Member plugin to a version later than 250905 that contains the fix for this vulnerability.
Other vulnerabilities in s2Member
See all- CVE-2026-86596Critical
The s2Member plugin for WordPress in versions up to and including 260927 is vulnerable to Remote Code Execution via the 'item_name' parameter. Insufficient sanitization in strip_php_tags_deep() only strips literal '<?' sequences, and a post-interpolation placeholder cleanup reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template.
- CVE-2026-15047Medium
The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post (stored XSS).
Original NVD description (English source)
Improper Control of Generation of Code ('Code Injection') vulnerability in Cristián Lávaque s2Member s2member.This issue affects s2Member: from n/a through 250905.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS