CVE-2026-91829 — Subscribe to Comments < 2.3.3 - Reflected XSS via 'ref' Parameter
The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to per…
Published: 2026-10-11 · CVSS: 7.1 · CVSS 3.1
The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7