EUVD-2026-60800
GHSA-4w8h-g4h9-3c46
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
AV:N/PR:N because unauthenticated network delivery; UI:R because victim click required; S:C for cross-context script execution; A:N as availability impact is not substantiated for a standard XSS.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.
AnalysisAI
Unauthenticated cross-site scripting in the Subscribe2 WordPress plugin (versions <= 10.46) allows a remote unauthenticated attacker to inject arbitrary JavaScript into pages rendered by victims who follow a crafted link. The CVSS scope-change metric (S:C) indicates the injected script executes outside the vulnerable component's security boundary, enabling session hijacking, credential theft, or unauthorized administrative actions against any user - including site administrators - who can be socially engineered into triggering the payload. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerability requires no authentication on the attacker's side - any unauthenticated internet user can craft the malicious payload (PR:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a meaningful but interaction-dependent risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WordPress site running Subscribe2 <= 10.46 and crafts a URL embedding a JavaScript payload in a parameter processed by the vulnerable plugin. The attacker delivers this URL to a site administrator via a phishing email or forum post; when the administrator clicks the link while authenticated to WordPress, the payload executes in their browser session, exfiltrating their session cookie or silently creating a rogue admin account. … |
| Remediation | The primary remediation is to update Subscribe2 to a version beyond 10.46 via the WordPress plugin dashboard or manual upload. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: disable or deactivate Subscribe2 plugin on all WordPress installations running version 10.46 or earlier; document affected systems and deployment scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Subscribe2
View allReflected XSS in the Subscribe2 WordPress plugin (versions before 10.46) allows an unauthenticated attacker to inject ar
The Subscribe2 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.40.
The Subscribe2 plugin for WordPress is vulnerable to unauthorized access to email functionality due to a missing capabil
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today