Description

Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T15:17:06.687Z",
  "pubdate": "2026-08-18T15:17:06.687Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the Subscribe2 plugin, specifically affecting versions 10.46 and prior.\nThis vulnerability allows remote, unauthenticated threat actors to inject arbitrary malicious scripts, typically JavaScript, into web pages rendered to other users or administrators visiting the affected WordPress application.\nThe primary impact of successful exploitation includes session hijacking, credential theft, redirection to malicious destinations, and unauthorized actions performed within the context of the victim's browser session.\nThe affected product is the Subscribe2 plugin for WordPress up to version 10.46.\nThe risk implications are significant, as the vulnerability does not require any prior authentication or special privileges, lowering the attack barrier for malicious actors.\nExploitation requirements are minimal, typically involving tricking a user or administrator into interacting with a crafted HTTP request or malicious link targeting the vulnerable endpoint within the plugin.",
  "technicalDetails": "The root cause of the vulnerability stems from improper input validation and insufficient output sanitization within the Subscribe2 plugin <= 10.46.\nUser-supplied input parameters processed by the plugin are reflected directly in HTTP responses without adequate contextual encoding or neutralization of dangerous HTML and JavaScript constructs.\nThe vulnerable component resides within the handling mechanisms of the Subscribe2 plugin where unauthenticated inputs are accepted and subsequently rendered back to the client.\nBecause the vulnerability is unauthenticated, no pre-existing user accounts, valid session tokens, or elevated privileges are required to initiate an attack.\nThe network exposure is external, meaning any remote attacker with HTTP or HTTPS access to the web server hosting the vulnerable WordPress instance can trigger the flaw.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious URL containing a payload designed to execute arbitrary JavaScript within the context of the victim's browser. Second, the attacker induces a target—such as an authenticated administrator or regular user—to access the crafted URL via social engineering or other delivery mechanisms. Third, the server processes the request, passes the unsanitized parameter through the vulnerable component of Subscribe2, and includes the malicious payload in the HTTP response. Fourth, the victim's browser receives the response, fails to sanitize the injected markup due to inadequate output encoding, and executes the payload within the security context of the origin site.\nThe payload behavior involves executing arbitrary client-side scripts, which can access Document Object Model (DOM) elements, read session cookies, steal authentication tokens, or force the browser to perform unauthorized state-changing requests on behalf of the victim.\nThe post-exploitation impact depends on the privileges of the victim interacting with the malicious payload; if an administrator is targeted, full compromise of the WordPress application may be achieved through administrative function abuse or file modification."
}