The s2Member WordPress plugin versions prior to 260805 fail to escape certain shortcode attributes before embedding them in inline JavaScript. This enables users with contributor-level privileges to perform stored XSS attacks by injecting malicious scripts that execute in the context of viewers opening the affected posts. The vulnerability is tracked as CWE-79 and was published on 2026-08-10. No CVSS score or vendor remediation information is currently available.

An attacker with contributor-level access can inject arbitrary JavaScript code into posts, which will execute in the browsers of users viewing those posts. This can lead to session hijacking, defacement, or other malicious actions executed in the context of the affected site. The vulnerability affects the confidentiality and integrity of users interacting with the compromised content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling shortcode usage or inline scripts in posts if possible.