CVE-2026-103422

7.2High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-79

Impact

Unauthenticated attackers can execute arbitrary JavaScript in an administrator's browser to hijack sessions or create admin accounts. An attacker only needs network access to the public REST endpoint to inject the script, which triggers when an admin views the AnyComment Subscriptions page.

Root cause

The /wp-json/anycomment/v1/subscribe REST endpoint does not sanitize the 'email' input, and AnyCommentSubscriptionsTable::column_default() renders that unescaped email directly into an HTML table cell.

Affected systems

AnyComment plugin for WordPress versions up to and including 0.3.6

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Fix & remediation

Upgrade to a version newer than 0.3.6 once available, or deactivate and delete the AnyComment plugin immediately if no patch is released.

shell

$ wp plugin deactivate anycomment

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in AnyCommentSubscriptionsTable::column_default(), which returns the stored email verbatim into an HTML <td> when the subscription's user_ID does not resolve to an existing WP_User. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the AnyComment → Subscriptions admin page.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-103422