CVE-2026-109972
s2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in all versions up to, and including, <= 261011 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses wp_kses_post() on save because it contains no literal angle brackets — only backslash-escaped sequences that PHP's date() materializes into HTML tag characters at render time after WordPress's shortcode_parse_atts() applies stripcslashes() to the attribute value.
| CWE | CWE-79 |
| Vendor | clavaque |
| Product | s2member – excellent for all kinds of memberships, content restriction paywalls & member access subscriptions |
| Published | Oct 28, 2026 |
| Last Updated | Oct 28, 2026 |
Get instant alerts for clavaque s2member – excellent for all kinds of memberships, content restriction paywalls & member access subscriptions
Be the first to know when new medium vulnerabilities affecting clavaque s2member – excellent for all kinds of memberships, content restriction paywalls & member access subscriptions are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N