Threats tagged 'ghsa-2wqw-8w6m-g247'

The s2Member WordPress plugin up to version 261011 is vulnerable to stored cross-site scripting (XSS) via the 'date_format' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, allowing payloads that bypass WordPress's wp_kses_post() filter by using backslash-escaped sequences that PHP's date() function converts into HTML tags at render time.