Read the docs
TI-2026-70489 Aliases CVE-2026-91829GHSA-prwf-5jq7-v6fg

Reflected XSS in Subscribe to Comments WordPress plugin

Priority LOW 30CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target. An unauthenticated attacker can craft a URL that runs script in the browser of anyone who clicks it, including administrators. The references link to an exploit.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00164 5th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Subscribe to Comments (Unknown): 2.3.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownSubscribe to Commentsbefore 2.3.32.3.3Patch availableCNA
  • Subscribe to Comments VendorUnknown Affected before 2.3.3 Fixed in 2.3.3 Patch available CNA

Remediation

Update the Subscribe to Comments WordPress plugin to version 2.3.3.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Subscribe to Comments (Unknown) Fixed in 2.3.3

Timeline

  1. 2026-10-11 Threatist record created from CVE-2026-91829
  2. 2026-10-11 Alias added: GHSA-prwf-5jq7-v6fg

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences