CVE-2026-14331

The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link.

Score

CVSS 3.1 6.1 Medium

Status

Deferred - contact@wpscan.com

Published

2026-08-07

Last modified

2026-08-07

Weaknesses

CWE-79

Affected products

• Subscribe2 (Unknown)

References

• https://wpscan.com/vulnerability/5ea58741-0c4c-4482-94dd-34721b19fc26/