The Subscribe2 WordPress plugin versions prior to 10.46 contain a reflected XSS vulnerability (CWE-79) due to improper escaping of user-supplied values in a public subscription form. An attacker can craft a malicious link that, when visited by an unauthenticated user, causes arbitrary JavaScript code to execute in that user's browser. This vulnerability is documented as CVE-2026-14331. No CVSS score or vendor advisory is currently available, and no patch or remediation guidance has been provided yet.

Successful exploitation allows execution of arbitrary JavaScript in the context of an unauthenticated visitor's browser. This can lead to session hijacking, redirection to malicious sites, or other client-side attacks targeting visitors interacting with the subscription form. There is no indication of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid clicking on suspicious subscription form links and consider disabling or restricting access to the Subscribe2 subscription form if feasible.