Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2024-51815

WordPress s2Member plugin <= 241114 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in Cristián Lávaque s2Member s2member allows Code Injection.This issue affects s2Member: from n/a through <= 241114.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Wp Sharks
Products
S2member Pro
CVE-2024-12563

s2Member Pro <= 250214 - Authenticated (Contributor+) Local File Inclusion to Remote Code Execution via Shortcode

The s2Member Pro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 250214 via the 'template' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wp Sharks
Products
Wordpress S2member Pro
CVE-2024-31237

WordPress s2Member plugin <= 240315 - Privilege Escalation vulnerability

Improper Privilege Management vulnerability in WP Sharks s2Member Pro allows Privilege Escalation.This issue affects s2Member Pro: from n/a through 240315.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wp Sharks
Products
S2member Pro