CVE-2026-66706

MediumCVSS 5.9

Published: 06/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

5th percentile - higher than 5% of all known CVEs

Summary

A Cross Site Scripting (XSS) vulnerability in the Subscribe to Comments plugin (versions up to 2.3.1) occurs at the author level. This means a user with the author role can inject a malicious script that executes in the browsers of other users.

Risk Assessment

An attacker with the author role can steal session data, take over user accounts, or spread malicious content. The risk affects all users visiting pages with the plugin.

Recommendation

It is recommended to update the Subscribe to Comments plugin to the latest version that includes the fix. Also, restrict author permissions and regularly audit user-published content.

Other vulnerabilities in Subscribe to Comments

CVE-2026-91829High
The Subscribe to Comments WordPress plugin before version 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators.

Original NVD description (English source)

Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS