EUVD-2026-115642

The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, = 260927 via the 'itemname' parameter parameter. This is due to insufficient sanitization in stripphptagsdeep, which only strips literal '?' sequences, combined with a post-interpolation...

CVE-2026-86596

The s2Member plugin for WordPress (versions <= 260927 ) is vulnerable to Remote Code Execution (RCE) via the 'item_name' IPN parameter. The flaw stems from insufficient sanitization in the strip_php_tags_deep() function, which only removes literal <? sequences. This, combined with a post-in...

CVE-2026-86596: clavaque: The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <=…

The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, = 260927 via the 'itemname' parameter parameter. This is due to insufficient sanitization in stripphptagsdeep, which only strips literal '' sequences, combined with a post-interpolation...