CVE-2026-14331 is a reflected Cross-Site Scripting (CWE-79) vulnerability in the Subscribe2 WordPress plugin prior to version 10.46. The flaw arises from improper escaping of user-supplied values that are reflected into a public subscription form. This allows an attacker to craft a malicious link that, when visited by an unauthenticated user, executes arbitrary script code in the victim's browser. This vulnerability affects the confidentiality and integrity of user interactions with the subscription form but does not impact availability.

Successful exploitation results in the execution of arbitrary scripts in the browser of an unauthenticated visitor interacting with the subscription form via a crafted link. This can lead to information disclosure and manipulation of client-side data within the context of the vulnerable site. There is no indication of impact on system availability or authenticated users from the provided data.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should exercise caution with untrusted input and consider temporary mitigations such as disabling the vulnerable form or applying web application firewall rules to block suspicious input patterns.