s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions vulnerabilities

Product

s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions

by clavaque · last CVE Oct 28, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities7 In the news0 Timeline

Severity mix

Critical 1High 2Medium 4Low 0

Severity

All severities7 Critical1 High2 Medium4 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-1994	9.8	0%	Feb 19	s2Member <= 260127 - Unauthenticated Privilege Escalation via Account Takeover Affected: through 260127
CVE-2026-19804	8.8	1%	Sep 25	s2Member <= 260814 - Unauthenticated Remote Code Execution via 'first_name' Parameter in PayPal Proxy Return Affected: through 260814
CVE-2024-8326	8.8	1%	Dec 17	s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241114 - Authenticated (Contributor+) Sensitive Information Exposure Affected: through 241114
CVE-2026-109972 New	6.4	0%	Oct 28	s2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute Affected: through 261011
CVE-2025-13732	6.4	0%	Feb 19	s2Member <= 251005 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Affected: through 251005
CVE-2024-11376	6.1	0%	Feb 18	s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241216 - Reflected Cross-Site Scripting Affected: through 241216
CVE-2024-0899	5.3	1%	Apr 9	s2Member – Best Membership Plugin for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 230815 - Information Exposure Affected: through 230815