AnyComment CVE-2026-103422

The AnyComment plugin must be active and exposing the public /wp-json/anycomment/v1/subscribe REST endpoint, which accepts subscriptions from unauthenticated users. The specific trigger is that the stored subscription's user_ID must NOT resolve to an existing WP_User - only then does AnyCommentSubscriptionsTable::column_default() emit the raw 'email' value into an HTML <td> without escaping. Exploitation is limited by the requirement that an administrator subsequently visit the AnyComment → Subscriptions admin page for the payload to fire; the payload does not execute against site visitors or the public comment stream, only within the authenticated admin dashboard.

This is a genuinely credible but second-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C) signals an easy, remotely reachable, unauthenticated injection, and the 7.2 (High) score is inflated primarily by the scope change (S:C) that reflects the payload crossing from the attacker-controlled public subscribe endpoint into a privileged admin browser context. However, the real-world impact is bounded: this is a stored XSS (CWE-79) with only Low confidentiality and Low integrity impact and no availability impact, and execution is contingent on an administrator actually opening the AnyComment → Subscriptions page. No EPSS score was provided, there is no CISA KEV listing, and no POC was indicated in the input, so there is no public exploit identified at time of analysis - do not treat this as actively exploited. The one point of tension to verify: the vector states UI:N, yet execution requires an administrator to navigate to the Subscriptions admin page, which some scorers would model as UI:R; this is a Wordfence-convention UI:N for payloads that auto-fire on routine admin page load, so the 'unauthenticated, no interaction' framing is slightly optimistic. Net: patch promptly on affected sites, but this is a targeted-opportunity admin-session-compromise bug, not a mass-exploitation emergency.

An unauthenticated attacker POSTs a subscription to the public /wp-json/anycomment/v1/subscribe endpoint with a JavaScript payload in the 'email' field, crafted so the subscription's user_ID does not resolve to an existing WP_User. The email is stored unsanitized and later rendered verbatim into a <td> on the AnyComment → Subscriptions admin page; when an administrator views that page the script executes in their authenticated session. No public exploit code was identified in the input, but the attack requires only a single crafted HTTP request.