This vulnerability, identified as CWE-79, exists in the Subscribe to Comments plugin (versions <= 2.3.1) developed by Mark Jaquith. It allows an authenticated user with high privileges to inject malicious scripts due to improper input sanitization during web page generation. The CVSS 3.1 base score is 5.9, reflecting a medium severity with network attack vector, low attack complexity, required privileges, and user interaction. The vulnerability can lead to partial confidentiality, integrity, and availability impacts. There is no vendor advisory or patch information currently available.

An attacker with high privileges and the ability to interact with the user interface can exploit this vulnerability to execute cross-site scripting attacks. This may result in partial compromise of confidentiality, integrity, and availability of the affected system. However, exploitation requires authenticated access and user interaction, limiting the scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high privilege user access and monitor for suspicious activity related to the plugin. Avoid exposing the plugin to untrusted users.