Vulnerabilities / s2Member
s2Member vulnerabilities
Advisories WPSec published for s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions. Other sources may list more. Its attack surface: s2Member on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-18 | WPSEC-2026-1209 | s2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via s2Get Shortcode | Medium 6.4 | 261017 |
| 2026-10-18 | WPSEC-2026-1208 | s2Member <= 261011 - Unauthenticated Denial of Service via REST API Collection Requests | Medium 5.3 | 261017 |
| 2026-10-14 | WPSEC-2026-0924 | s2Member <= 261001 - Unauthenticated Missing Authorization to Protected Content via REST API | Medium 5.3 | 261011 |
| 2026-10-01 | WPSEC-2026-0219 | s2Member <= 260913 - Authenticated (Subscriber+) Remote Code Execution via Custom Profile Fields in Payment Notification Emails and Tracking Codes | High 7.5 | 260917 |
| 2026-10-01 | WPSEC-2026-0218 | s2Member <= 260913 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute | High 7.5 | 260917 |
License: CC BY 4.0