CVE-2026-109972

Name of the Vulnerable Software and Affected Versions s2Member versions prior to 261012

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. By manipulating the date format parameter, an attacker can inject arbitrary web scripts into pages. The attack bypasses the wp kses post() function during the save process by using backslash-escaped sequences instead of literal angle brackets. These sequences are later converted into HTML tag characters by the PHP date() function after the shortcode parse atts() function applies stripcslashes() to the attribute value.

Recommendations Update s2Member to a version newer than 261011. Avoid using the date format parameter in shortcodes until the update is applied.