Skip to content
Sign in
7.1 High

CVE-2026-91829 The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into…

Description

The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators.

Affected products and versions

Product Affected versions Fixed in
Subscribe to Comments 2.3 earliest → < 2.3.3 2.3.3

Other CVEs of Subscribe to Comments

The 3 CVEs of Subscribe to Comments →
CVE-2026-91831 The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification… 3.8 Low CVE-2026-91830 The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a… 6.5 Medium
Track this CVE