What is the CVSS score of CVE-2026-66706?

CVE-2026-66706 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Subscribe to Comments CVE-2026-66706

EUVD-2026-53909 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-2j9x-ww5c-7853

WordPress XSS Wordpress Plugin Subscribe To Comments

5.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.9 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

4.8 MEDIUM

High privilege and user interaction required limit reach; scope changes to victim browser, but XSS carries no credible availability impact.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:02 vuln.today

DescriptionCVE.org

Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions.

AnalysisAI

Stored Cross-Site Scripting in the WordPress Subscribe to Comments plugin (versions up to and including 2.3.1) allows a high-privileged authenticated attacker to inject malicious scripts via author-related fields, which execute in the browsers of other users who view the affected content. The vulnerability carries a CVSS 3.1 score of 5.9 with scope change (S:C), meaning the impact crosses the security boundary from the plugin into victims' browser sessions. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the network-accessible attack surface and scope change elevate practical concern for multi-tenant or high-traffic WordPress deployments.

Technical ContextAI

Subscribe to Comments is a WordPress plugin authored by Mark Jaquith (CPE: cpe:2.3:a:mark_jaquith:subscribe_to_comments:*:*:*:*:*:*:*:*) that enables visitors to subscribe to comment threads via email notifications. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS pattern where user-supplied author data is persisted to the database and later rendered into HTML without adequate output encoding or escaping. The WordPress plugin ecosystem historically treats author display fields as trusted for high-privilege users, making sanitization oversights common in older plugins. The scope change (S:C) in the CVSS vector confirms the payload executes outside the plugin's own security context - in the victim's browser - enabling session hijacking, credential theft, or malicious redirects against authenticated site visitors or administrators.

RemediationAI

The primary remediation is to update the Subscribe to Comments plugin to a version beyond 2.3.1 if a patched release has been published to the WordPress Plugin Repository - check the plugin's changelog at wordpress.org/plugins/subscribe-to-comments for any version superseding 2.3.1. Note: the provided reference data confirms the vulnerability exists through 2.3.1 but does not specify an exact patched version; this should be verified directly at the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/subscribe-to-comments/vulnerability/wordpress-subscribe-to-comments-plugin-2-3-1-cross-site-scripting-xss-vulnerability). If no updated version is available, immediate compensating controls include: disabling or deactivating the Subscribe to Comments plugin entirely until a patch is released (trade-off: loss of email subscription functionality for commenters); restricting the WordPress Author and Editor roles to fully trusted users only, since exploitation requires high-privilege access (PR:H); and deploying a web application firewall rule to filter XSS payloads in comment author fields as a partial mitigation (trade-off: may cause false positives on legitimate content).