{"id":"CVE-2026-120531","kind":"vulnerability","aliases":["CVE-2026-120531"],"related":[],"title":"Subscribe2 WordPress plugin: unauthenticated stored script injection via data[ip]","description":"The Subscribe2 – Form, Email Subscribers & Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data[ip]’ parameter in all versions up to, and including, 10.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","summary":"Subscribe2 up to 10.47 stored the signup IP from the AJAX subscription form without validation and showed it unescaped in the admin Subscribers list, so an anonymous visitor could plant a script that runs in an administrator's browser. Fixed in 10.48.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"subscribe2","fixed":["10.48"],"affected":"<= 10.47","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","self-hosted","subscribe2","wordpress"],"not_affected_if":["plugin-not-installed","plugin-updated","popup-form-disabled"],"how_to_check":"- WordPress admin > Plugins: affected if Subscribe2 is 10.47 or older; fixed in 10.48.\n- Per the changelog, the injection path is the AJAX subscription form, available when the popup style subscription form is enabled: check Subscribe2 > Settings for the popup style form.\n- Look at Subscribe2 > Subscribers for signup IP values containing HTML or script; delete any such entries.","fix":"Update Subscribe2 to 10.48 or later (Plugins > Installed Plugins > Update).","status":"open","published_at":"2026-11-07T22:16:36+00:00","first_seen_at":"2026-11-07T22:19:09+00:00","triaged_at":"2026-11-07T22:20:17+00:00","updated_at":"2026-11-07T22:21:47+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-07T22:20:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Subscribe2 WordPress plugin: unauthenticated stored script injection via data[ip]","impact":"medium","summary":"The Subscribe2 WordPress newsletter plugin fails to sanitize the data[ip] parameter, so unauthenticated visitors can store scripts. Those scripts run in the browser of anyone who opens the affected page, which can include site administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","subscribe2","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in visitors' browsers, possibly admin sessions","analyst_note":"Confirm the fixed plugin version and whether the flaw is reachable on default settings, from the NVD entry or the plugin vendor's changelog.","how_to_check":"- Check the installed Subscribe2 plugin version in the WordPress admin under Plugins; affected if it is `10.47` or older.\n- Confirm whether the plugin is active on the site.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-updated"],"who_is_affected":"Any WordPress site running Subscribe2 at version 10.47 or earlier is exposed, because the flaw is reachable without logging in. Sites without the plugin installed or active are not affected. unknown whether the sources name a fixed version.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000701,"input_tokens":4285,"output_tokens":545,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed plugin version and whether the flaw is reachable on default settings, from the NVD entry or the plugin vendor's changelog.","search":"'-120531':13A,16A '-2026':12A,15A '10.47':27B,95C '10.48':65B 'access':124C 'admin':45B 'administr':60B 'ajax':34B 'anonym':50B 'arbitrari':113C 'attack':110C 'browser':62B 'could':52B 'cross':80C 'cross-sit':79C 'cve':11A,14A 'data':9A,85C 'due':96C 'email':69C 'escap':103C 'execut':120C 'fix':63B 'form':36B,68C 'host':21B 'includ':94C 'inject':7A,112C,126C 'input':99C 'insuffici':98C 'ip':10A,31B,86C 'list':47B 'make':105C 'newslett':71C 'output':102C 'packag':18B 'page':117C,127C 'paramet':87C 'plant':53B 'plugin':3A,72C 'possibl':107C 'run':57B 'sanit':100C 'script':6A,55B,82C,115C 'self':20B 'self-host':19B 'show':40B 'signup':30B 'site':81C 'store':5A,28B,78C 'subscrib':46B,70C 'subscribe2':1A,17A,22B,24B,67C 'subscript':35B 'unauthent':4A,109C 'unescap':42B 'user':123C 'valid':38B 'version':90C 'via':8A,83C 'visitor':51B 'vulner':76C 'web':114C 'whenev':121C 'without':37B 'wordpress':2A,23B,74C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running Subscribe2 10.47 or older. Per the plugin changelog, the injection comes through the AJAX subscription form, available when the popup style subscription form is enabled, and runs when an administrator opens the Subscribers list. Sites without the plugin, with 10.48+, or without the popup form can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T22:21:47Z","by":"analyst","doc":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/subscribe2/subscribe2-form-email-subscribers-newsletters-1047-unauthenticated-stored-cross-site-scripting-via-dataip-parameter","run_id":2150},"how_to_check":{"at":"2026-11-07T22:21:47Z","by":"analyst","doc":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/subscribe2/subscribe2-form-email-subscribers-newsletters-1047-unauthenticated-stored-cross-site-scripting-via-dataip-parameter","run_id":2150}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["subscribe2"],"ptokens":["subscribe2"],"labels":["high","package","selfhosted","subscribe2","wordpress"],"campaign_type":null,"search_a":"'-120531':13A,16A '-2026':12A,15A 'cve':11A,14A 'data':9A 'inject':7A 'ip':10A 'plugin':3A 'script':6A 'store':5A 'subscribe2':1A,17A 'unauthent':4A 'via':8A 'wordpress':2A","search_b":"'10.47':27B '10.48':65B 'admin':45B 'administr':60B 'ajax':34B 'anonym':50B 'browser':62B 'could':52B 'fix':63B 'form':36B 'host':21B 'ip':31B 'list':47B 'packag':18B 'plant':53B 'run':57B 'script':55B 'self':20B 'self-host':19B 'show':40B 'signup':30B 'store':28B 'subscrib':46B 'subscribe2':22B,24B 'subscript':35B 'unescap':42B 'valid':38B 'visitor':51B 'without':37B 'wordpress':23B","search_c":"'10.47':95C 'access':124C 'arbitrari':113C 'attack':110C 'cross':80C 'cross-sit':79C 'data':85C 'due':96C 'email':69C 'escap':103C 'execut':120C 'form':68C 'includ':94C 'inject':112C,126C 'input':99C 'insuffici':98C 'ip':86C 'make':105C 'newslett':71C 'output':102C 'page':117C,127C 'paramet':87C 'plugin':72C 'possibl':107C 'sanit':100C 'script':82C,115C 'site':81C 'store':78C 'subscrib':70C 'subscribe2':67C 'unauthent':109C 'user':123C 'version':90C 'via':83C 'vulner':76C 'web':114C 'whenev':121C 'wordpress':74C","first_public_at":"2026-11-07T22:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120531","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120531","severity":null,"published_at":"2026-11-07T22:16:36+00:00","modified_at":"2026-11-07T22:16:36+00:00","first_seen_at":"2026-11-07T22:19:09+00:00","fetched_at":"2026-11-07T22:19:09+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120531:2150","url":"https://wordpress.org/plugins/subscribe2/","severity":null,"published_at":"2026-11-07T22:21:47+00:00","modified_at":"2026-11-07T22:21:47+00:00","first_seen_at":"2026-11-07T22:21:47+00:00","fetched_at":"2026-11-07T22:21:47+00:00","note":"Fix 10.48 (released 23 Sep 2026) per wordpress.org changelog; Wordfence advisory confirms. Changelog: reachable via AJAX subscription form when popup style form is enabled; stored IP rendered unescaped in admin Subscribers list (admin browser). Verified fix and how_to_check from maintainer changelog.","cites":["https://wordpress.org/plugins/subscribe2/","https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/subscribe2/subscribe2-form-email-subscribers-newsletters-1047-unauthenticated-stored-cross-site-scripting-via-dataip-parameter"]}],"documents":[{"id":98256,"url":"https://wordpress.org/plugins/subscribe2/","title":"Subscribe2 plugin page and changelog (10.48)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":98257,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/subscribe2/subscribe2-form-email-subscribers-newsletters-1047-unauthenticated-stored-cross-site-scripting-via-dataip-parameter","title":"Wordfence: Subscribe2 <= 10.47 stored XSS via data[ip]","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}