CVE-2026-15047CWE-79cross-site-scripting

CVE-2026-15047

Medium · published August 10, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
36.3
In the wild
Unconfirmed
What it is

The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post (stored XSS).

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00431 · 36.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-10T11:16Z
References (1)
https://wpscan.com/vulnerability/79e830c3-232b-4eff-8cf1-d25c5310984c/ · [email protected]
EPSS history
Timeline
  • 10 AUG 06:00Z
    s2Member < 260805 - Contributor+ Stored XSS via Shortcode
    cvelistv5