Stored Cross-Site Scripting in s2Member Plugin for WordPress
CVE-2026-109972

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
S2member – Excellent For All Kinds Of Memberships, Content Restriction Paywalls & Member Access Subscriptions
Vendor
CVE Published:
28 October 2026

What is CVE-2026-109972?

The s2Member plugin for WordPress has a vulnerability that allows authenticated users with contributor-level access and above to execute arbitrary web scripts. This occurs through the 'date_format' parameter due to insufficient input sanitization and output escaping. Attackers can utilize crafted payloads that exploit this flaw, resulting in the insertion of malicious scripts on pages that subsequently execute when accessed. The vulnerability bypasses common sanitization functions in WordPress, enabling potential security breaches within affected installations.

Affected Version(s)

s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions 0 <= 261011

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/s2member/trunk...
https://plugins.trac.wordpress.org/browser/s2member/trunk...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.