Clavaque vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Clavaque products: 2 record(s), with severity, exploitation and fixes.

s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions 2

Exploited only (KEV) →

CVE-2026-1994 Critical · 9.8 CWE-269 Feb 19, 2026

s2Member <= 260127 - Unauthenticated Privilege Escalation via Account Takeover

The s2Member plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 260127. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

CVE-2025-13732 Medium · 6.4 CWE-79 Feb 19, 2026

s2Member <= 251005 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 's2Eot' shortcode in all versions up to, and including, 251005 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.