Subscribe To Comments
Subscribe To Comments allows visitors to subscribe to notifications about new comments on selected posts.
Subscribe To Comments (subscribe-to-comments) is a WordPress plugin with 7 published CVE records in this archive. The latest tracked vulnerability was published Oct 19, 2026; the highest published CVSS base score is 7.2.
subscribe-to-commentsCVE-2026-91831: Subscribe to Comments: Email header injection through sender settings
The Subscribe to Comments WordPress plugin from 2.3 up to, but not including, 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender. The export does not name an endpoint, action, parameter or function beyond the operation described. The CNA narrative names Author access or higher, while the accompanying CVSS vector rates required privileges as high; this source discrepancy is retained rather than substituting a different WordPress role. The completed CNA record identifies 2.3.3 as fixed.
| Safe version |
|
||
|---|---|---|---|
| Oct 19, 2026 |
CVE-2026-91831
Subscribe to Comments: Email header injection through sender settings
The Subscribe to Comments WordPress plugin from 2.3 up to, but not including, 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender. The export does not name an endpoint, action, parameter or function beyond the operation described. The CNA narrative names Author access or higher, while the accompanying CVSS vector rates required privileges as high; this source discrepancy is retained rather than substituting a different WordPress role. The completed CNA record identifies 2.3.3 as fixed.
|
2.3.3 |
CVE3.8
|
| Oct 16, 2026 |
CVE-2026-91830
Subscribe to Comments: Sensitive information exposure
The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions. The export supplies no additional endpoint, action, parameter or function details beyond those described above.
|
2.3.3 |
CVE6.5
|
| Oct 11, 2026 |
CVE-2026-91829
Subscribe to Comments: Cross-site scripting
An unauthenticated attacker can craft a link containing script-bearing target-parameter input. The component reflects that input without sufficient escaping, so a user who follows the link can execute attacker-controlled JavaScript in the site’s origin, including in an administrator’s browser. The export does not disclose the exact endpoint or parameter name. Affected versions: < 2.3.3. The authoritative export identifies 2.3.3 as fixed for this CVE.
|
2.3.3 |
CVE7.1
|
| Aug 06, 2026 |
CVE-2026-66706
Subscribe to Comments permits Author-level cross-site scripting
Subscribe to Comments through 2.3.1 permits an authenticated Author or higher to inject browser-executable content.
|
> 2.3.1 |
CVE5.9
|
| Jul 19, 2025 |
CVE-2015-10133
Subscribe To Comments: Filesystem traversal
Subscribe To Comments is affected by filesystem traversal. Exploitation requires an authenticated WordPress account. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE7.2
|
| Oct 30, 2024 |
CVE-2024-8792
Subscribe to Comments: Cross-site scripting
Subscribe to Comments is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
|
| Mar 05, 2023 |
CVE-2006-10001
Subscribe To Comments: Cross-site scripting
Subscribe To Comments is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE3.5
|