Skip to content
Sign in
6.1 Medium

CVE-2026-14331 The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a…

Description

The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link.

Affected products and versions

Product Affected versions Fixed in
Subscribe2 10.46 earliest → < 10.46 10.46

Other CVEs of Subscribe2

The 2 CVEs of Subscribe2 →
CVE-2022-4309 The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers… 3.1 Low
Track this CVE