WordPress Plugin Vulnerabilities

s2Member < 260805 - Contributor+ Stored XSS via Shortcode

Description

The plugin does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post (stored XSS).

Proof of Concept

Affects Plugins

Plugin icon
s2member
Fixed in 260805

References

CVE
CVE-2026-15047

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Muni Nitish Kumar Yaddala
Submitter
Muni Nitish Kumar Yaddala
Verified
Yes
WPVDB ID
79e830c3-232b-4eff-8cf1-d25c5310984c

Timeline

Publicly Published
2026-08-07 (about 3 days ago)
Added
2026-08-07 (about 2 days ago)
Last Updated
2026-08-07 (about 2 days ago)

Other

Published
Title
Published
2019-10-02
Title
Download Plugins and Themes from Dashboard < 1.6.0 - Unauthenticated Stored XSS
Published
2025-07-23
Title
Supreme Addons for Beaver Builder <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_qrcodesabb Shortcode
Published
2026-05-01
Title
Maxi Blocks < 2.1.10 - Authenticated (Author+) Stored Cross-Site Scripting via Style Card REST API
Published
2024-12-11
Title
Horizontal scroll image slideshow <= 10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2026-05-26
Title
ShopLentor - WooCommerce Builder for Elementor & Gutenberg < 3.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Product Grid 'blockUniqId' Block Attribute