CVE-2025-13732

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13732", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-26T00:18:26.982Z", "datePublished": "2026-02-19T04:36:06.236Z", "dateUpdated": "2026-04-08T16:36:34.028Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:34.028Z"}, "affected": [{"vendor": "clavaque", "product": "s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "251005", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 's2Eot' shortcode in all versions up to, and including, 251005 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "s2Member <= 251005 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/130f34d8-462a-4812-8526-67beb9ad5efb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/sc-eots-in.inc.php#L45"}, {"url": "https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/sc-eots-in.inc.php#L112"}, {"url": "https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/sc-eots-in.inc.php#L161"}, {"url": "https://plugins.trac.wordpress.org/changeset/3430799"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2026-02-18T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T17:04:03.974385Z", "id": "CVE-2025-13732", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:39:43.235Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13732", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T17:04:03.974385Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:04:05.740Z"}}], "cna": {"title": "s2Member <= 251005 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "clavaque", "product": "s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "251005"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-18T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/130f34d8-462a-4812-8526-67beb9ad5efb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/sc-eots-in.inc.php#L45"}, {"url": "https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/sc-eots-in.inc.php#L112"}, {"url": "https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/sc-eots-in.inc.php#L161"}, {"url": "https://plugins.trac.wordpress.org/changeset/3430799"}], "descriptions": [{"lang": "en", "value": "The s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 's2Eot' shortcode in all versions up to, and including, 251005 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:34.028Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13732", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:36:34.028Z", "dateReserved": "2025-11-26T00:18:26.982Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-19T04:36:06.236Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions", "vendor": "clavaque", "versions": [{"lessThanOrEqual": "251005", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 's2Eot' shortcode in all versions up to, and including, 251005 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin s2Member \u2013 Excellent para All Kinds of Memberships, Content Restriction Paywalls &amp; Member Access Subscriptions para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del shortcode 's2Eot' del plugin en todas las versiones hasta la 251005, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto permite que atacantes autenticados, con acceso de nivel Colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-13732", "lastModified": "2026-06-17T08:34:39.780", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13732", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T17:04:03.974385Z", "version": "2.0.3"}}]}, "published": "2026-02-19T07:17:32.883", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/sc-eots-in.inc.php#L112"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/sc-eots-in.inc.php#L161"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/sc-eots-in.inc.php#L45"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3430799"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/130f34d8-462a-4812-8526-67beb9ad5efb?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,251005]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions", "source": "cna", "vendor": "clavaque"}, "product": "s2member_\u2013_excellent_for_all_kinds_of_memberships,_content_restriction_paywalls_&_member_access_subscriptions", "vendor": "clavaque"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-22T15:26:18.959720+00:00", "value": {"mitigation_remediation": ["Update the s2Member plugin to a version newer than 251005 (e.g., 251006 or later).", "Remove or replace the 's2Eot' shortcode from any pages, posts, or templates that contain it. If the shortcode is not needed, consider disabling it through the plugin settings or custom code.", "Restrict the Contributor role so that users cannot edit content containing the shortcode, or remove Contributor privileges entirely if not required."], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All installations of the s2Member plugin for WordPress with version numbers up to and including 251005 are impacted. The plugin, developed by clavaque, is widely used for membership sites and content restriction paywalls.", "description_and_impact": "The vulnerability is a stored cross\u2011site scripting flaw in the s2Member WordPress plugin that permits authenticated users with Contributor level or higher to inject arbitrary JavaScript via the plugin\u2019s 's2Eot' shortcode. Improper input sanitization and lack of output escaping enable the attacker to embed malicious scripts that execute in the browsers of anyone who visits an affected page. This can lead to theft of user sessions, defacement, or other client\u2011side compromise, but it does not grant direct server\u2011side code execution.", "risk_and_exploitability": "The CVSS base score of 6.4 indicates a moderate level of severity. However the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a low current exploitation probability. The attack requires an authenticated Contributor or higher, meaning that the threat surface is limited to sites that grant such permissions. Successful exploitation could result in cross\u2011site scripting in the context of the users viewing the affected content, potentially enabling theft of credentials for logged\u2011in administrators."}}}}, "created": "2026-02-19T10:07:24.261392+00:00", "updated": "2026-04-22T15:30:20.779893+00:00", "vendors": ["clavaque", "clavaque$PRODUCT$s2member_\u2013_excellent_for_all_kinds_of_memberships,_content_restriction_paywalls_&_member_access_subscriptions", "wordpress", "wordpress$PRODUCT$wordpress"]}