Clavaque vulnerabilities
We track 4 vulnerabilities in Clavaque products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on November 2, 2026.
Latest Clavaque vulnerabilities
- 9.8 Critical severity
s2Member – Excellent for All Kinds of…: Improper Control of Generation of Code
The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?'
- 8.8 High severity
s2Member – Excellent for All Kinds of…: Improper Control of Generation of Code
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the 'first_name' parameter parameter.
- 9.8 Critical severity
s2Member – Excellent for All Kinds of…: Improper Privilege Management
The s2Member plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 260127. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possi
- 8.8 High severity
s2Member – Excellent for All Kinds of…: Exposure of Sensitive Information to an Unauthorized Actor
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 241114 via the 'sc_get_details' functio