CVE-2026-91829
7.1HighPublished 11 Oct 2026 · NVD status: Deferred
7.1High
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
The AI triage for this one isn't ready yet. Check back in a few minutes; the full NVD record is below in the meantime.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Ad · In-content banner
NVD description
The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators.