Subscribe2 CVE-2026-73393

The vulnerability requires no authentication on the attacker's side - any unauthenticated internet user can craft the malicious payload (PR:N). The single mandatory prerequisite is victim interaction: the target must follow an attacker-controlled link or visit an attacker-influenced page that triggers the XSS (UI:R). The most impactful exploitation scenario requires the victim to be an authenticated WordPress administrator at the time of interaction, enabling elevated post-exploitation actions such as account creation or plugin installation; however, the XSS fires regardless of the victim's privilege level. No non-default WordPress configuration, specific hosting environment, or additional plugin is indicated as required. Exploitation is limited to sites where the Subscribe2 plugin is installed and active; sites without the plugin are entirely unaffected.

The NVD CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a meaningful but interaction-dependent risk. The zero-privilege, network-accessible attack path (AV:N/PR:N/AC:L) means any unauthenticated internet actor can craft a payload - no account or special access required. However, UI:R (user interaction required) is the key limiting factor: exploitation depends on a victim clicking a malicious link, making this phishing-dependent. EPSS data is not present in the provided intelligence; exploitation probability cannot be quantitatively assessed. There is no CISA KEV listing and no confirmed public proof-of-concept, placing this in the 'patching priority' category rather than 'emergency response.' The A:L metric in the provided vector is unusual for a typical XSS and may reflect denial-of-service potential via script injection; this warrants verification against the Patchstack advisory. Real-world impact is highest when an administrator account is targeted, as XSS in that context can lead to full site compromise through script-driven admin actions.

An attacker identifies a WordPress site running Subscribe2 <= 10.46 and crafts a URL embedding a JavaScript payload in a parameter processed by the vulnerable plugin. The attacker delivers this URL to a site administrator via a phishing email or forum post; when the administrator clicks the link while authenticated to WordPress, the payload executes in their browser session, exfiltrating their session cookie or silently creating a rogue admin account. No public proof-of-concept code has been confirmed, but the attack technique is standard for unauthenticated reflected XSS and requires no specialized skill beyond basic web exploitation knowledge.