CVE-2025-62023

CriticalCVSS 9.0

Published: 22/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 29/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

34th percentile - higher than 34% of all known CVEs

Summary

Improper Control of Generation of Code ('Code Injection') vulnerability in Cristián Lávaque s2Member s2member. This issue affects s2Member: from n/a through 250905.

Risk Assessment

An attacker can inject and execute arbitrary code within the WordPress context, potentially leading to site takeover and compromise of user data.

Recommendation

Update the s2Member plugin to a version later than 250905 that contains the fix for this vulnerability.

Other vulnerabilities in s2Member

CVE-2026-15047Medium
The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post (stored XSS).

Original NVD description (English source)

Improper Control of Generation of Code ('Code Injection') vulnerability in Cristián Lávaque s2Member s2member.This issue affects s2Member: from n/a through 250905.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS