S2Member
Monthly
Stored cross-site scripting in the s2Member WordPress plugin (all versions before 260805) allows contributors to inject arbitrary JavaScript into post content via unescaped shortcode attributes rendered inside an inline script block. Any site visitor who opens the affected post will execute the attacker's script in their browser. A publicly available proof-of-concept exploit exists, reported by WPScan, though EPSS sits at the 5th percentile suggesting opportunistic rather than widespread active exploitation at time of analysis.
The s2Member - Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The s2Member Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 241216 via deserialization of untrusted input from the 's2member_pro_remote_op'. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting in the s2Member WordPress plugin (all versions before 260805) allows contributors to inject arbitrary JavaScript into post content via unescaped shortcode attributes rendered inside an inline script block. Any site visitor who opens the affected post will execute the attacker's script in their browser. A publicly available proof-of-concept exploit exists, reported by WPScan, though EPSS sits at the 5th percentile suggesting opportunistic rather than widespread active exploitation at time of analysis.
The s2Member - Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The s2Member Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 241216 via deserialization of untrusted input from the 's2member_pro_remote_op'. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.