The s2Member WordPress plugin is vulnerable to stored cross‑site scripting through the date_format shortcode attribute. Insufficient sanitization allows an authenticated user with contributor‑level access to embed obfuscated script payloads that materialize into executable tags when the page renders. Attackers can thus inject arbitrary JavaScript that will run in the browsers of any visitor to the affected content, compromising confidentiality and integrity of the site content and potentially enabling credential theft or defacement.

WordPress sites running the s2Member plugin version 261011 or earlier. The vendor is clavaque, and the product is the s2Member Membership plugin. All installations of the plugin with contributor or higher roles are at risk.

The CVSS score of 6.4 indicates moderate impact; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Authenticated attackers with contributor privileges can exploit the stored XSS without needing to trick end users into clicking a link, which raises the likelihood of successful exploitation in environments where contributor access is widely granted. The lack of an available public exploit does not eliminate the risk, as the flaw requires only normal user interaction with the WordPress admin interface.