CVE-2026-15047

The s2Member WordPress plugin is affected by CVE-2026-15047 (pre-260805). The vulnerability arises because several shortcode attributes are not escaped before being output inside an inline script context, enabling stored XSS where users with contributor-level access can inject arbitrary JavaScrip...