https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T02:18:56.583541+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-15047 CVE-2026-15047 — s2Member < 260805 - Contributor+ Stored XSS via Shortcode 2026-10-09T02:18:56.584674+00:00

Affected: Unknown s2Member

The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post (stored XSS).