A Cross-Site Scripting (XSS) vulnerability exists in the s2Member plugin by Cristián Lávaque due to improper neutralization of script-related HTML tags. This vulnerability allows an attacker to inject code into web pages. It affects s2Member versions up to 261106. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality only.