CVE-2026-19804

The s2Member plugin for WordPress (versions up to and including 260814 ) is vulnerable to Remote Code Execution (RCE) . The root cause is insufficient sanitization of the first_name parameter using esc_refs(), which fails to strip PHP tags before they are substituted into an eval'd Signup Trackin...