S2member

Records2All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

S2member records in CISA KEV

No S2member vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

S2member 2 records MEDIUM

Records

2 records

TI-2024-11656 CVE-2024-12562 · GHSA-wjr9-hj62-43j7

s2Member Pro <= 241216 - Unauthenticated PHP Object Injection

MEDIUM 45

The s2Member Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 241216 via deserialization of untrusted input from the 's2member_pro_remote_op' vulnerable parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00949 Published 2025-02-15 No fix listed CWE-502

TI-2011-04359 CVE-2011-5082 · GHSA-2gph-8pg4-626q

Cross-site scripting (XSS) vulnerability in the s2Member Pro plugin before 111220 for…

LOW 24

Cross-site scripting (XSS) vulnerability in the s2Member Pro plugin before 111220 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s2member_pro_authnet_checkout[coupon] parameter (aka…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0183 Published 2012-03-19 No fix listed CWE-79

Open these records in search →

Critical	1
High	0
Medium	1
Low	0
No CVSS	0