Subscribe to Comments CVE-2026-91829

Exploitation requires that a victim click an attacker-crafted URL targeting the Subscribe to Comments plugin (versions before 2.3.3), where a specific parameter is reflected unvalidated into a link target; per the CVSS vector (PR:N) no authentication is needed by the attacker. The key LIMITING factor is mandatory user interaction (UI:R) - the attack does not fire automatically and depends on social-engineering a user, ideally a logged-in administrator, into following the malicious link. Impact is also bounded to a single victim's browser session per click (reflected, not stored). No special server configuration is cited as a prerequisite in the description, but the vulnerable plugin must be installed and active and the target below 2.3.3.

Signals are largely consistent and point to a moderate, user-interaction-gated web vulnerability rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1 High) shows a network-reachable, low-complexity, unauthenticated flaw, but the required UI:R (victim must click a crafted URL) and the limited (Low) impact to confidentiality/integrity/availability temper the real-world severity - this is characteristic of reflected XSS, not a wormable RCE. Public exploit code exists (WPScan), which raises the practical likelihood of opportunistic use, but there is NO CISA KEV listing and NO EPSS score was provided in the input, so I cannot quantify exploitation probability; the absence of EPSS/KEV should not be read as 'safe,' only as 'unconfirmed widespread exploitation.' No SSVC decision data (exploitation/automatable/technical-impact) was supplied. Net assessment: a credible, prioritize-for-patching issue - especially because successful exploitation can target administrators who click a malicious link - but it is not a drop-everything mass-exploitation threat given the user-interaction requirement and Low impact metrics.

An attacker crafts a malicious URL for the vulnerable plugin where an unvalidated parameter is reflected into a link target, then delivers it to a victim (e.g., a WordPress administrator) via phishing, a comment, or a planted link. When the victim clicks, attacker-controlled script executes in their browser in the site's context, enabling session/cookie theft or actions on the victim's behalf. Public exploit details are available from WPScan, lowering the effort required to reproduce the attack.