Executive brief
s2Member is a WordPress plugin that manages access control and membership features. The plugin fails to properly escape shortcode attributes before embedding them into inline JavaScript code, allowing contributors to inject malicious JavaScript that executes when anyone views the affected post. This can lead to account compromise, data theft, or malware distribution to all visitors including administrators.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in shortcode attribute handling. The s2Member plugin processes several shortcode attributes (player_title, player_description, player_tracks, player_option_blocks) without proper escaping before inserting them into inline JavaScript context within the JW Player library setup code. An attacker with contributor-level access can craft a post containing a malicious [s2Stream] shortcode with base64-encoded JavaScript payloads in these attributes; the payload bypasses wp_kses validation because it resides in shortcode attributes rather than raw HTML. When an editor publishes the post and any viewer opens it, the unescaped JavaScript executes in the viewer's browser session with no additional interaction required. The vulnerability affects s2Member versions before 260805 and requires a WordPress multisite setup or DISALLOW_UNFILTERED_HTML configuration to be exploitable by contributors.
Affected products
- s2Member s2Member before 260805
Timeline
- 2026-08-07: disclosed
- 2026-08-10: advisory