CVE-2026-109972: s2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute

Q: Who can exploit this issue?

An attacker needs an authenticated WordPress account with Contributor-level access or higher. They must be able to place a malicious s2Member shortcode using the date_format attribute into content that is later viewed by another user.

Q: What versions are affected?

All s2Member versions up to and including 261011 are affected, based on the provided advisory.

Q: Does an attacker need to include obvious HTML tags in the stored payload?

No. The payload can use backslash-escaped sequences rather than literal angle brackets, allowing it to bypass wp_kses_post() during saving. The sequences are converted into HTML tag characters when the shortcode is rendered.

Q: How can I determine whether exploitation may have occurred?

Review content created or edited by Contributor-level and higher users for s2Member shortcodes containing a date_format attribute, especially values with backslash-escaped character sequences. Affected payloads execute when a user visits the page containing the injected shortcode.

Published Oct 28, 2026

Updated

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dateformat' parameter in all versions up to, and including, <= 261011 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses wpksespost() on save because it contains no literal angle brackets — only backslash-escaped sequences that PHP's date() materializes into HTML tag characters at render time after WordPress's shortcodeparseatts() applies stripcslashes() to the attribute value.

Affected Software

1 affected component

s2Member s2Member<=261011

Event History

Oct 28, 2026

CVE Published

via MITRE·06:45 AM

Data Sourced

via MITRE·06:45 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs an authenticated WordPress account with Contributor-level access or higher. They must be able to place a malicious s2Member shortcode using the date_format attribute into content that is later viewed by another user.

What versions are affected?

All s2Member versions up to and including 261011 are affected, based on the provided advisory.

Does an attacker need to include obvious HTML tags in the stored payload?

No. The payload can use backslash-escaped sequences rather than literal angle brackets, allowing it to bypass wp_kses_post() during saving. The sequences are converted into HTML tag characters when the shortcode is rendered.

How can I determine whether exploitation may have occurred?

Review content created or edited by Contributor-level and higher users for s2Member shortcodes containing a date_format attribute, especially values with backslash-escaped character sequences. Affected payloads execute when a user visits the page containing the injected shortcode.

CVE-2026-109972: s2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What versions are affected?

Does an attacker need to include obvious HTML tags in the stored payload?

How can I determine whether exploitation may have occurred?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What versions are affected?

Does an attacker need to include obvious HTML tags in the stored payload?

How can I determine whether exploitation may have occurred?