CVE-2026-14331
Subscribe2 < 10.46 - Reflected XSS via email Parameter
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link.
| Vendor | unknown |
| Product | subscribe2 |
| Published | Aug 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown subscribe2
Be the first to know when new unknown vulnerabilities affecting unknown subscribe2 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Subscribe2
0 < 10.46
References
Credits
Omar Elshopky WPScan