CVE-2026-91829: CWE-79 Cross-Site Scripting (XSS) in Subscribe to Comments

The Subscribe to Comments WordPress plugin versions prior to 2.3.3 contain a reflected XSS vulnerability (CWE-79). This occurs because the plugin does not properly validate input parameters before reflecting them into a link target. An unauthenticated attacker can exploit this by crafting a malicious URL that, when clicked by any user including administrators, executes arbitrary script code in their browser context.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to session hijacking, unauthorized actions performed on behalf of the user, or other malicious activities within the scope of the affected site user. The vulnerability affects any user who clicks the crafted URL, including privileged users such as administrators.

A fixed version of the Subscribe to Comments plugin (2.3.3 or later) addresses this vulnerability. Users should upgrade to version 2.3.3 or newer to remediate the issue. Since no official patch link was provided, users should verify the update availability from the official plugin repository or vendor site. Until updated, avoid clicking suspicious URLs related to the plugin.