CVE-2026-91829

HighCVSS 7.1

Published: 11/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 11/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

The Subscribe to Comments WordPress plugin before version 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators.

Risk Assessment

The risk includes malicious script execution in the victim's browser, which can lead to session theft, administrator account takeover, or malware distribution. The attack can be performed without authentication.

Recommendation

Update the Subscribe to Comments plugin to version 2.3.3 or later. Also inform users about the risk of clicking suspicious links.

Other vulnerabilities in Subscribe to Comments

CVE-2026-66706Medium
A Cross Site Scripting (XSS) vulnerability in the Subscribe to Comments plugin (versions up to 2.3.1) occurs at the author level. This means a user with the author role can inject a malicious script that executes in the browsers of other users.

Original NVD description (English source)

The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS