The s2Member WordPress plugin, for any version prior to 260805, fails to escape several shortcode attributes before inserting them into an inline script block. Contributors can therefore inject arbitrary JavaScript that is stored in the post and executed when a viewer opens the post, leading to a stored XSS flaw.

WordPress sites using the s2Member plugin with a version less than 260805 are affected. The vulnerability applies to all users with contributor or higher privileges who can add or edit posts containing shortcodes.

Based on the description, it is inferred that if a contributor inserts a malicious shortcode, the plugin will store the unescaped JavaScript and render it inside an inline script block, executing in the browsers of any visitor who opens the post. Consequently, an attacker with contributor privileges can compromise site visitors by injecting and storing code. The risk is significant for sites that expose sensitive data or rely on user authentication. No EPSS score is available and the vulnerability is not yet listed in the CISA KEV catalog, but the lack of input escaping and the inline script context make exploitation straightforward for authenticated users.