Vulnerabilities

TI-2025-36642 CVE-2025-58998 · GHSA-8rx4-fj24-3rqc

WordPress s2Member Plugin <= 250701 - PHP Object Injection Vulnerability

MEDIUM 49

Deserialization of Untrusted Data vulnerability in Cristián Lávaque s2Member s2member allows Object Injection.This issue affects s2Member: from n/a through <= 250701.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00503 Published 2025-11-06 No fix listed CWE-502

TI-2025-38346 CVE-2025-62023 · GHSA-82m2-w5q8-xfh9

WordPress s2Member plugin <= 250905 - Remote Code Execution (RCE) vulnerability

MEDIUM 41

Improper Control of Generation of Code ('Code Injection') vulnerability in Cristián Lávaque s2Member s2member.This issue affects s2Member: from n/a through 250905.

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.0039 Published 2025-10-22 No fix listed CWE-94

TI-2025-23235 CVE-2025-32137 · GHSA-292w-2m2h-rw25

WordPress s2Member plugin <= 250419 - Local File Inclusion vulnerability

LOW 24

Relative Path Traversal vulnerability in Cristián Lávaque s2Member s2member allows Path Traversal.This issue affects s2Member: from n/a through <= 250419.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00799 Published 2025-04-04 No fix listed CWE-23

TI-2025-19750 CVE-2025-26879 · GHSA-hxcq-fj5p-qg8j

WordPress s2Member Plugin <= 241216 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristián Lávaque s2Member s2member allows Reflected XSS.This issue affects s2Member: from n/a through <= 241216.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00318 Published 2025-03-03 No fix listed CWE-79

TI-2024-34719 CVE-2024-51815 · GHSA-fj85-3hpv-97rg

WordPress s2Member plugin <= 241114 - Remote Code Execution (RCE) vulnerability