EUVD-2026-54995
GHSA-7g36-jx9h-h5j4
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Contributor is low-privilege (PR:L), scope changes because XSS executes in victim's browser (S:C), and impacts are limited to session/content manipulation rather than full system compromise.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post (stored XSS).
AnalysisAI
Stored cross-site scripting in the s2Member WordPress plugin (all versions before 260805) allows contributors to inject arbitrary JavaScript into post content via unescaped shortcode attributes rendered inside an inline script block. Any site visitor who opens the affected post will execute the attacker's script in their browser. A publicly available proof-of-concept exploit exists, reported by WPScan, though EPSS sits at the 5th percentile suggesting opportunistic rather than widespread active exploitation at time of analysis.
Technical ContextAI
s2Member is a WordPress membership and subscription management plugin. The vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) stems from the plugin failing to sanitize or escape shortcode attribute values before embedding them into inline JavaScript blocks within rendered HTML. Because the injection lands inside a script context rather than HTML text, standard HTML-entity encoding is insufficient - JavaScript string escaping is required. The affected CPE is cpe:2.3:a:unknown:s2member:*:*:*:*:*:*:*:* covering all versions below 260805. The stored nature of the XSS means the malicious payload persists in the database and fires for every visitor, not just the original requester.
RemediationAI
Update s2Member to version 260805 or later immediately - this is a vendor-released patch and the primary fix. The WPScan advisory at https://wpscan.com/vulnerability/79e830c3-232b-4eff-8cf1-d25c5310984c/ and VulnDB entry https://vuldb.com/vuln/387310 confirm patch availability. If immediate patching is not possible, revoke or audit all contributor-level accounts on the site and prevent new contributor registrations - this removes the attacker's foothold. Additionally, a Web Application Firewall (WAF) rule blocking shortcode attribute injection patterns can reduce risk but may produce false positives on legitimate s2Member shortcode usage. Note that disabling contributor roles site-wide may break editorial workflows. Patching is strongly preferred over all workarounds.
The s2Member Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 241216
The s2Member - Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today