CVE-2014-2274: Subscribe To Comments Reloaded Project Subscribe To Comments Reloaded

High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days.

Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via a request to the subscribe-to-comments-reloaded/options/index.php page to wp-admin/admin.php.

Affected products

• Subscribe To Comments Reloaded Project Subscribe To Comments Reloaded: up to and including 140204

Published 2018-03-19. Last modified 2026-06-17.