s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions vulnerabilities

Product

s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions

by clavaque · last CVE Oct 28, 2026

CVEs

On KEV

8.8

Max CVSS

New 30D

Vulnerabilities2 In the news0 Timeline

Severity mix

Critical 0High 1Medium 1Low 0

Severity

All severities2 Critical0 High1 Medium1 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-19804	8.8	1%	Sep 25	s2Member <= 260814 - Unauthenticated Remote Code Execution via 'first_name' Parameter in PayPal Proxy Return Affected: through 260814
CVE-2026-109972 New	6.4	–	Oct 28	s2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute Affected: through 261011