Advisories · Technology

Cristián Lávaque s2Member.

Every CVE that names Cristián Lávaque s2Member among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-125440 CVE record

CVSS 5.3 Medium

WordPress s2Member plugin <= 261106 - Content Injection vulnerability
- Cristián Lávaque s2Member
- Cross-site scripting (XSS)
Not analysed yet 13 Nov 2026
CVE-2025-58998 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress s2Member Plugin <= 250701 - PHP Object Injection Vulnerability
- Cristián Lávaque s2Member
- Insecure deserialization
Not analysed yet 6 Nov 2025
CVE-2025-62023 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

WordPress s2Member plugin <= 250905 - Remote Code Execution (RCE) vulnerability
- Cristián Lávaque s2Member
- Code injection
Not analysed yet 22 Oct 2025
CVE-2025-32137 CVE record

CVSS 4.9 Medium

WordPress s2Member plugin <= 250419 - Local File Inclusion vulnerability
- Cristián Lávaque s2Member
- Path traversal
Not analysed yet 4 Apr 2025
CVE-2025-26879 CVE record

CVSS 7.1 High

WordPress s2Member Plugin <= 241216 - Reflected Cross Site Scripting (XSS) vulnerability
- Cristián Lávaque s2Member
- Cross-site scripting (XSS)
Not analysed yet 3 Mar 2025
CVE-2024-51815 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

WordPress s2Member plugin <= 241114 - Remote Code Execution (RCE) vulnerability
- Cristián Lávaque s2Member
- Code injection
Not analysed yet 6 Dec 2024