The Subscribe2 – Form, Email Subscribers & Newsletters WordPress plugin suffers from a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation. Specifically, the 'ip' parameter is not properly sanitized or escaped, enabling unauthenticated attackers to inject malicious scripts that persist and execute in the context of users visiting the injected pages. This vulnerability affects all versions up to and including 10.43 and is tracked as CVE-2024-11582 with a CVSS 3.1 base score of 7.2, indicating a high severity risk.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of users viewing the affected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.