s2Member CVE-2026-109972

Requires an authenticated WordPress account with contributor-level privileges or higher on a site running s2Member version 261011 or earlier; a fully unauthenticated attacker cannot exploit this. The attacker must be able to place an s2Member shortcode and supply a crafted 'date_format' attribute value consisting of backslash-escaped sequences (not literal angle brackets) so the payload survives wp_kses_post() on save and is then converted into HTML tag characters by PHP's date() at render time (after shortcode_parse_atts() applies stripcslashes()). The stored payload fires whenever any user - including higher-privileged admins - views the injected page. Limiting factors: the contributor-account prerequisite, the plugin being installed with the vulnerable shortcode usable, and the version ceiling; sites that grant author/editor/admin roles only to fully trusted staff face substantially lower real-world risk.

This is a genuine but moderate-priority issue, not a drop-everything emergency. The CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) is elevated by the scope change (S:C), which correctly reflects that a stored XSS payload injected by a low-privileged contributor executes in the browser context of other users who view the page. The key risk-limiting signal is PR:L: exploitation requires an authenticated account with contributor-level access or above, so this is not reachable by anonymous internet attackers. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a self-restricted, authenticated-only web flaw. No EPSS probability, no CISA KEV listing, and no public exploit code were provided in the input, so there is no signal of active or widespread exploitation; absence of these is not evidence of safety but does argue against imminent mass exploitation. The description is unusually specific about mechanism - a sanitization bypass where backslash-escaped sequences survive wp_kses_post() because they contain no literal angle brackets, then PHP's date() materializes them into HTML tag characters at render time after shortcode_parse_atts() applies stripcslashes() - which raises confidence that the vulnerability is real and well understood. Net assessment: a credible stored-XSS privilege-boundary bypass worth patching on a normal cycle, with real impact on sites that grant contributor accounts to semi-trusted users; low real risk where all authors are fully trusted administrators.

A site operator grants contributor-level accounts to guest writers. A malicious contributor saves a post or page containing the vulnerable s2Member shortcode with a crafted 'date_format' attribute built from backslash-escaped sequences that pass wp_kses_post() because they contain no literal angle brackets. When an administrator or other visitor later views that page, PHP's date() renders the escaped sequences into live HTML/script tags and the script executes in the victim's browser, enabling session/cookie theft or actions as the viewing user. No public exploit code was identified in the provided sources, though the description documents the bypass technique in detail.