Aller au contenu
Se connecter
6.1 Moyenne

CVE-2026-14331 The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a…

Description

The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link.

Produits et versions touchés

Produit Versions touchées Corrigé en
Subscribe2 10.46 premières → < 10.46 10.46

Autres CVE de Subscribe2

Les 2 CVE de Subscribe2 →
CVE-2022-4309 The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers… 3.1 Faible
Suivre cette CVE