CVE-2026-91073 is a stored Cross-Site Scripting vulnerability in the Subscribe Forms WordPress plugin prior to version 1.6.3. The vulnerability arises from insufficient sanitization and escaping of a form setting, allowing authenticated users with Author role or higher to inject malicious scripts. These scripts execute in the context of any visitor viewing a page embedding the vulnerable form, potentially compromising user sessions or performing other malicious actions in the victim's browser.

Successful exploitation allows an authenticated user with Author or higher privileges to inject persistent malicious scripts into pages containing the Subscribe Forms plugin. These scripts execute in the browsers of all visitors to the page, including logged-out users and administrators, potentially leading to session hijacking, defacement, or other client-side attacks.

Upgrade the Subscribe Forms plugin to version 1.6.3 or later, where this vulnerability has been fixed. No other mitigation is required if the plugin is updated. Patch status is confirmed by the version range indicating the fix in 1.6.3.