CVE-2026-109972 | clavaque s2Member Plugin up to 261011 on WordPress shortcode wp_kses_post date_format cross site scripting (ID 261011)

October 28, 2026 Yanac

A vulnerability described as problematic has been identified in clavaque s2Member Plugin up to 261011 on WordPress. Impacted is the function wp_kses_post of the component shortcode Handler. The manipulation of the argument date_format results in cross site scripting.

This vulnerability is known as CVE-2026-109972. It is possible to launch the attack remotely. No exploit is available.

It is advisable to implement a patch to correct this issue.VulDB Recent EntriesRead More