Vendor

clavaque

8 known vulnerabilities.

Products

s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions 8

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

Critical 9.8

CVE-2026-86596 Public exploit

s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter

The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?'…

clavaque s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions Web / CMS

Nov 2, 2026
Critical 9.8

CVE-2026-1994

s2Member <= 260127 - Unauthenticated Privilege Escalation via Account Takeover

The s2Member plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 260127. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it poss…

clavaque s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions Web / CMS

Feb 19, 2026