CVE-2026-103422

22th percentile - higher than 22% of all known CVEs

The AnyComment plugin for WordPress in versions up to and including 0.3.6 is vulnerable to Stored Cross-Site Scripting via the 'email' parameter. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in AnyCommentSubscriptionsTable::column_default(), which returns the stored email verbatim into an HTML <td> when the subscription's user_ID does not resolve to an existing WP_User. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the AnyComment → Subscriptions admin page.

An attacker can execute arbitrary JavaScript in an administrator's browser, potentially leading to session theft or account takeover. The risk is high because exploitation requires no authentication and targets the admin panel.

Update the AnyComment plugin to a version later than 0.3.6 as soon as it becomes available. In the meantime, consider disabling the public /wp-json/anycomment/v1/subscribe REST endpoint or restricting access to it.