EUVD-2026-54376
GHSA-m3cj-4969-qh2q
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Reflected XSS via crafted link mandates victim interaction (UI:R) and crosses into browser scope (S:C); no attacker privileges required and no server-side availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link.
AnalysisAI
Reflected XSS in the Subscribe2 WordPress plugin (versions before 10.46) allows an unauthenticated attacker to inject arbitrary JavaScript into a public subscription form by luring a visitor to a crafted link. Exploitation requires the victim to interact with the malicious URL - no server-side authentication is needed - enabling session theft, credential harvesting, or DOM-based actions scoped to the victim's browser. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Subscribe2 WordPress plugin must be installed, active, and at a version earlier than 10.46 on the target site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 6.1 (Medium) is consistent with the attack profile: network-reachable (AV:N), low complexity (AC:L), no attacker privileges (PR:N), but requiring victim interaction (UI:R) and constrained to low confidentiality and integrity impact (C:L/I:L) with no availability impact (A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WordPress site running a vulnerable Subscribe2 plugin version and constructs a URL to the public subscription form embedding a JavaScript payload in the vulnerable query parameter. The attacker distributes the link via a phishing email disguised as a newsletter confirmation or subscription invitation, targeting the site's existing subscriber base. … |
| Remediation | Update the Subscribe2 plugin to version 10.46 or later, which applies proper output escaping to the vulnerable subscription form parameter; this is the vendor-released patch confirmed by WPScan's advisory at https://wpscan.com/vulnerability/5ea58741-0c4c-4482-94dd-34721b19fc26/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Subscribe2
View allUnauthenticated cross-site scripting in the Subscribe2 WordPress plugin (versions <= 10.46) allows a remote unauthentica
The Subscribe2 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.40.
The Subscribe2 plugin for WordPress is vulnerable to unauthorized access to email functionality due to a missing capabil
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today