CVE-2026-91829: Unknown Subscribe To Comments

High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days.

The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators.

Affected products

• Unknown Subscribe To Comments: before 2.3.3 (fixed in 2.3.3)

Published 2026-10-11. Last modified 2026-10-13.