CVE-2026-15047
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post (stored XSS).
Risk Assessment
Risk of user session hijacking, data theft, or malware propagation.
Recommendation
Update the s2Member plugin to version 260805 or later.
Other vulnerabilities in s2Member
See all- CVE-2026-86596Critical
The s2Member plugin for WordPress in versions up to and including 260927 is vulnerable to Remote Code Execution via the 'item_name' parameter. Insufficient sanitization in strip_php_tags_deep() only strips literal '<?' sequences, and a post-interpolation placeholder cleanup reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template.
- CVE-2025-62023Critical
Improper Control of Generation of Code ('Code Injection') vulnerability in Cristián Lávaque s2Member s2member. This issue affects s2Member: from n/a through 250905.
Original NVD description (English source)
The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post (stored XSS).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS