CVE-2026-103422: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ateshabaev AnyComment

CVE-2026-103422 describes a stored cross-site scripting vulnerability in the AnyComment plugin for WordPress, affecting versions up to and including 0.3.6. The vulnerability is due to improper neutralization of input during web page generation (CWE-79). Specifically, the 'email' parameter in the /wp-json/anycomment/v1/subscribe REST endpoint is not properly sanitized, and the stored email is output without escaping in the AnyCommentSubscriptionsTable::column_default() method. This allows unauthenticated attackers to inject arbitrary scripts that execute when an administrator accesses the AnyComment → Subscriptions admin page.

An unauthenticated attacker can inject malicious scripts via the 'email' parameter that will execute in the context of an administrator's browser when they view the Subscriptions admin page. This can lead to partial confidentiality and integrity loss (CVSS impact: Confidentiality Low, Integrity Low, Availability None). The vulnerability could be used to perform actions such as session hijacking or unauthorized actions within the admin interface.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict access to the AnyComment → Subscriptions admin page to trusted administrators only and consider disabling the plugin if possible. Avoid entering untrusted email addresses via the vulnerable REST endpoint.