Subscribe To Comments Vulnerabilities

The Subscribe to Comments plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in p...

CVSS:

5.4

Affected:

up to 2.3.1

Fix:

No patched version reported

Disclosed:

Aug 6, 2026

CVE-2026-66706 on NVD →

The Subscribe to Comments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if...

CVSS:

6.1

Affected:

up to 2.3

Fixed in:

2.3.1

Disclosed:

Oct 29, 2024

CVE-2024-8792 on NVD →

The Subscribe to Comments for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.1.2 via the Path to header value. This allows authenticated attackers, with administrative privileges and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code...

CVSS:

7.2

Affected:

up to 2.1.2

Fixed in:

2.3

Disclosed:

Jul 15, 2015

CVE-2015-10133 on NVD →

The Subscribe to Comments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI in all versions up to, and including, 2.0.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execut...

CVSS:

6.1

Affected:

up to 2.0.7

Fixed in:

2.0.8

Disclosed:

Sep 17, 2006

CVE-2006-10001 on NVD →