The vulnerability is a stored cross‑site scripting flaw in the s2Member WordPress plugin that permits authenticated users with Contributor level or higher to inject arbitrary JavaScript via the plugin’s 's2Eot' shortcode. Improper input sanitization and lack of output escaping enable the attacker to embed malicious scripts that execute in the browsers of anyone who visits an affected page. This can lead to theft of user sessions, defacement, or other client‑side compromise, but it does not grant direct server‑side code execution.

All installations of the s2Member plugin for WordPress with version numbers up to and including 251005 are impacted. The plugin, developed by clavaque, is widely used for membership sites and content restriction paywalls.

The CVSS base score of 6.4 indicates a moderate level of severity. However the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a low current exploitation probability. The attack requires an authenticated Contributor or higher, meaning that the threat surface is limited to sites that grant such permissions. Successful exploitation could result in cross‑site scripting in the context of the users viewing the affected content, potentially enabling theft of credentials for logged‑in administrators.