WordPress plugin
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 16 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical4
- High6
- Medium6
- Low0
All s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Critical9.8 | Unauthenticated Remote Code Execution via 'item_name' IPN Parameter ≤260927Update to 261001 | CVE-2026-86596 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute ≤261011Update to 261017 | CVE-2026-109972 | |
| High8.8 | Unauthenticated Remote Code Execution via 'first_name' Parameter in PayPal Proxy Return ≤260814Update to 260829 | CVE-2026-19804 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤260804Update to 260805 | CVE-2026-15047 | |
| Critical9.8 | Unauthenticated Privilege Escalation via Account Takeover ≤260127Update to 260215 | CVE-2026-1994 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤251005Update to 260101 | CVE-2025-13732 | |
| Critical9.8 | Unauthenticated Remote Code Execution ≤250905Update to 251005 | CVE-2025-62023 | |
| High8.1 | Unauthenticated PHP Object Injection ≤250701Update to 250905 | CVE-2025-58998 | |
| High7.2 | Authenticated (Administrator+) Local File Inclusion ≤250419Update to 250424 | CVE-2025-32137 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤241216Update to 250214 | CVE-2025-26879 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤241216Update to 250214 | CVE-2024-11376 | |
| High8.8 | Authenticated (Contributor+) Sensitive Information Exposure ≤241114Update to 241216 | CVE-2024-8326 | |
| High8.1 | Unauthenticated Remote Code Execution ≤241114Update to 241216 | CVE-2024-51815 | |
| Critical9.1 | Limited Privilege Escalation ≤240315Update to 240325 | CVE-2024-31237 | |
| Medium5.3 | Information Exposure ≤230815Update to 240315 | CVE-2024-0899 | |
| High7.2 | Cross-Site Scripting <111220Update to 111220 | CVE-2011-5082 |
- Critical9.8Unauthenticated Remote Code Execution via 'item_name' IPN Parameter
≤260927Update to 261001
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute
≤261011Update to 261017
- High8.8Unauthenticated Remote Code Execution via 'first_name' Parameter in PayPal Proxy Return
≤260814Update to 260829
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤260804Update to 260805
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
≤260127Update to 260215
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤251005Update to 260101
- Critical9.8Unauthenticated Remote Code Execution
≤250905Update to 251005
- High8.1Unauthenticated PHP Object Injection
≤250701Update to 250905
- High7.2Authenticated (Administrator+) Local File Inclusion
≤250419Update to 250424
- Medium6.1Reflected Cross-Site Scripting
≤241216Update to 250214
- Medium6.1Reflected Cross-Site Scripting
≤241216Update to 250214
- High8.8Authenticated (Contributor+) Sensitive Information Exposure
≤241114Update to 241216
- High8.1Unauthenticated Remote Code Execution
≤241114Update to 241216
- Critical9.1Limited Privilege Escalation
≤240315Update to 240325
- Medium5.3Information Exposure
≤230815Update to 240315
- High7.2Cross-Site Scripting
<111220Update to 111220
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions: common questions
Does s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions have known vulnerabilities?
Yes. VulnCrest Radar lists 16 known vulnerabilities in s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions: 4 critical, 6 high, 6 medium. None are known to affect version null.
How do I check which version of s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions vulnerability?
CVE-2026-86596, published Nov 2, 2026: s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter. Severity: Critical (CVSS 9.8).
Is any s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions vulnerability listed in CISA KEV?
No. None of the known s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions vulnerabilities is currently listed in the CISA KEV catalog.