CVE Catalog
CVE-2026-15047
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk0.15%
5th percentile - higher than 5% of all known CVEs
Summary
The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post (stored XSS).
Risk Assessment
Risk of user session hijacking, data theft, or malware propagation.
Recommendation
Update the s2Member plugin to version 260805 or later.
Original NVD description (English source)
The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post (stored XSS).