CVE-2026-73393 is an unauthenticated cross-site scripting (XSS) vulnerability in the weDevs Subscribe2 plugin, affecting versions up to 10.46. The issue arises from improper neutralization of user input during web page generation, classified under CWE-79. The vulnerability allows remote attackers to inject malicious scripts that could lead to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). No vendor advisory or patch is currently available, and no known exploits have been reported in the wild.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary scripts in the context of the affected web application. This can lead to partial compromise of confidentiality, integrity, and availability of the system as per the CVSS score of 7.1. The vulnerability affects the web interface of Subscribe2, potentially impacting users interacting with the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying web application firewall (WAF) rules to detect and block XSS payloads targeting Subscribe2 or disable the plugin if feasible. Monitor vendor communications for updates on patches or official mitigations.