https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T06:31:46.204751+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-351124 EUVD-2026-351124 2026-10-09T06:31:46.250966+00:00 EUVD-2026-351124 https://cve.radiocsirt.org/vuln/fkie_cve-2026-15047 fkie_cve-2026-15047 2026-10-09T06:31:46.251005+00:00

The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post (stored XSS).

 https://cve.radiocsirt.org/vuln/ghsa-7g36-jx9h-h5j4 GHSA-7g36-jx9h-h5j4 2026-10-09T06:31:46.251038+00:00

The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post (stored XSS).