# CVE-2026-15047: s2Member WordPress plugin stored XSS via shortcode attributes

Source: https://junglewise.ai/threats/cve-2026-15047-s2member-wordpress-plugin-stored-xss-via-shortcode-attributes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-15047 · Severity: medium · CVSS 6.8 · Published 2026-08-10

s2Member is a WordPress plugin that manages access control and membership features. The plugin fails to properly escape shortcode attributes before embedding them into inline JavaScript code, allowing contributors to inject malicious JavaScript that executes when anyone views the affected post. This can lead to account compromise, data theft, or malware distribution to all visitors including administrators.

Technologies: [s2Member](https://junglewise.ai/threats/technologies/s2member). Vendors: [s2Member](https://junglewise.ai/threats/vendors/s2member).

## Quick answers

**Is CVE-2026-15047 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15047 being exploited in the wild.

**How severe is CVE-2026-15047?** Medium severity, with a CVSS score of 6.8, published 10 August 2026.

**Which products and versions are affected?** s2Member before 260805.

**Is there a fix for CVE-2026-15047?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15047 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15047?** Check whether you run s2Member at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in shortcode attribute handling. The s2Member plugin processes several shortcode attributes (player_title, player_description, player_tracks, player_option_blocks) without proper escaping before inserting them into inline JavaScript context within the JW Player library setup code. An attacker with contributor-level access can craft a post containing a malicious [s2Stream] shortcode with base64-encoded JavaScript payloads in these attributes; the payload bypasses wp_kses validation because it resides in shortcode attributes rather than raw HTML. When an editor publishes the post and any viewer opens it, the unescaped JavaScript executes in the viewer's browser session with no additional interaction required. The vulnerability affects s2Member versions before 260805 and requires a WordPress multisite setup or DISALLOW_UNFILTERED_HTML configuration to be exploitable by contributors.

## Affected products

- s2Member s2Member before 260805

## Timeline

- 2026-08-07: disclosed
- 2026-08-10: advisory

## References

- [https://wpscan.com/vulnerability/79e830c3-232b-4eff-8cf1-d25c5310984c/](https://wpscan.com/vulnerability/79e830c3-232b-4eff-8cf1-d25c5310984c/)

## Related threats

- [s2Member WordPress plugin remote code execution via item_name](https://junglewise.ai/threats/cve-2026-86596-the-s2member-plugin-for-wordpress-is-vulnerable-to-remote-code)
- [s2Member Stored Cross-Site Scripting in date_format parameter](https://junglewise.ai/threats/cve-2026-109972-the-s2member-excellent-for-all-kinds-of-memberships-content)
- [s2Member code execution in Signup Tracking Codes](https://junglewise.ai/threats/cve-2026-19804-the-s2member-excellent-for-all-kinds-of-memberships-content)