EUVD-2026-54995
GHSA-7g36-jx9h-h5j4
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Contributor is low-privilege (PR:L), scope changes because XSS executes in victim's browser (S:C), and impacts are limited to session/content manipulation rather than full system compromise.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post (stored XSS).
AnalysisAI
Stored cross-site scripting in the s2Member WordPress plugin (all versions before 260805) allows contributors to inject arbitrary JavaScript into post content via unescaped shortcode attributes rendered inside an inline script block. Any site visitor who opens the affected post will execute the attacker's script in their browser. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) an account with at minimum contributor-level access on the target WordPress site - this can be a registered account on sites with open registration or a compromised existing account; (2) the s2Member plugin version below 260805 must be installed and active; (3) a victim (any site visitor, including unauthenticated users) must open the post containing the malicious shortcode. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 6.8 reflects network reachability, low attack complexity, high privileges required (PR:H as scored), required user interaction, and unchanged scope with high C/I/A - but these impact ratings assume worst-case session hijacking against an administrator. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or compromises a contributor account on a WordPress site running s2Member before 260805 and creates a post containing a malicious s2Member shortcode with a JavaScript payload embedded in an attribute value. Because the plugin outputs the attribute value verbatim inside an inline script block, every user who opens the post - including logged-in administrators - executes the attacker's JavaScript, which can steal session cookies, redirect victims to phishing pages, or silently create rogue admin accounts. … |
| Remediation | Update s2Member to version 260805 or later immediately - this is a vendor-released patch and the primary fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The s2Member Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 241216
The s2Member - Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today