{"id":"CVE-2026-91829","published":"2026-10-11T07:17:29.193","lastModified":"2026-10-13T16:29:21.907","description":"The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators.","cvssScore":7.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/1ed0314d-9871-4914-bb9c-ff894ea4c400/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}