CVE-2014-6604: SUBSCRIBE2 Project SUBSCRIBE2

Medium severity, CVSS 6.1. EPSS: 1.2% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in class-s2-list-table.php in the Subscribe2 plugin before 10.16 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ip parameter.

Affected products

• SUBSCRIBE2 Project SUBSCRIBE2: before 10.16 (fixed in 10.16)

Published 2018-03-29. Last modified 2026-06-17.