Subscribe Forms CVE-2026-91073

Requires an authenticated WordPress account with the Author role or higher on a site running Subscribe Forms before 1.6.3, and the attacker must edit a form's vulnerable setting. Payload only fires when a victim loads a page that embeds the affected form (UI:R), so a public-facing page must actually use the form. Limiting factors: privileged account needed (not unauthenticated), victim page-view required, and the impact is client-side script execution rather than direct server compromise. This is not remotely exploitable against a default install without an Author+ credential.

Real-world risk is moderate and gated by privilege, not a top-tier priority. The WPScan/NVD CVSS 3.1 vector (6.8, AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) requires an authenticated actor at Author level or above, and requires a visitor to view the page (UI:R), so exploitation is neither drive-by nor unauthenticated. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or automated exploitation - this is a disclosure-driven finding, not an observed campaign. Two internal inconsistencies should be flagged: (1) the vector encodes PR:H yet the description says the attacker only needs the Author role, which is a low-privilege contributor tier - PR:L is more defensible than PR:H; and (2) it encodes S:U with a full C:H/I:H/A:H triad, but a stored XSS whose payload deliberately runs in administrator and logged-out visitor sessions crosses a privilege/security boundary (S:C) while realistically delivering C:L/I:L rather than a full high triad. Net: a genuine stored-XSS defect worth patching, but the 6.8 is somewhat inflated by an overstated impact triad and an arguably wrong PR value.

An attacker who holds (or phishes/registers into) an Author-level account on the WordPress site edits a Subscribe Forms form and places a JavaScript payload in the vulnerable form setting, which is not escaped when the form is rendered. When any visitor - including a logged-out reader or an administrator browsing the site - loads a page embedding that form, the script executes in their session, enabling session/cookie theft or admin-action forgery. No public exploit code was identified at time of analysis.