---
id: "CVE-2026-120531"
page: "https://infrastack.ai/live/CVE-2026-120531"
kind: "vulnerability"
aliases: ["CVE-2026-120531"]
title: "Subscribe2 WordPress plugin: unauthenticated stored script injection via data[ip]"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "subscribe2", "fixed": ["10.48"], "affected": "<= 10.47", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "self-hosted", "subscribe2", "wordpress"]
not_affected_if: ["plugin-not-installed", "plugin-updated", "popup-form-disabled"]
published_at: "2026-11-07T22:16:36+00:00"
first_seen_at: "2026-11-07T22:19:09+00:00"
updated_at: "2026-11-07T22:21:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120531", "first_seen_at": "2026-11-07T22:19:09+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/subscribe2/subscribe2-form-email-subscribers-newsletters-1047-unauthenticated-stored-cross-site-scripting-via-dataip-parameter", "first_seen_at": "2026-11-07T22:21:47+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/subscribe2/subscribe2-form-email-subscribers-newsletters-1047-unauthenticated-stored-cross-site-scripting-via-dataip-parameter", "https://wordpress.org/plugins/subscribe2/"]}]
exploit_sources: []
---

# Subscribe2 WordPress plugin: unauthenticated stored script injection via data[ip]

Link for people: https://infrastack.ai/live/CVE-2026-120531 (this .md is for agents)

Subscribe2 up to 10.47 stored the signup IP from the AJAX subscription form without validation and showed it unescaped in the admin Subscribers list, so an anonymous visitor could plant a script that runs in an administrator's browser. Fixed in 10.48.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:subscribe2 affected <= 10.47 fixed 10.48

## How to check

- WordPress admin > Plugins: affected if Subscribe2 is 10.47 or older; fixed in 10.48.
- Per the changelog, the injection path is the AJAX subscription form, available when the popup style subscription form is enabled: check Subscribe2 > Settings for the popup style form.
- Look at Subscribe2 > Subscribers for signup IP values containing HTML or script; delete any such entries.

## Fix

Update Subscribe2 to 10.48 or later (Plugins > Installed Plugins > Update).

## Timeline

- 2026-11-07T22:19:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120531
- 2026-11-07T22:21:47+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/subscribe2/subscribe2-form-email-subscribers-newsletters-1047-unauthenticated-stored-cross-site-scripting-via-dataip-parameter — Fix 10.48 (released 23 Sep 2026) per wordpress.org changelog; Wordfence advisory confirms. Changelog: reachable via AJAX subscription form when popup style form is enabled; stored IP rendered unescaped in admin Subscribers list (admin browser). Verified fix and how_to_check from maintainer changelog.

## Documents

- [advisory] Wordfence: Subscribe2 <= 10.47 stored XSS via data[ip] https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/subscribe2/subscribe2-form-email-subscribers-newsletters-1047-unauthenticated-stored-cross-site-scripting-via-dataip-parameter
- [fix] Subscribe2 plugin page and changelog (10.48) https://wordpress.org/plugins/subscribe2/

## From the sources

The Subscribe2 – Form, Email Subscribers & Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data[ip]’ parameter in all versions up to, and including, 10.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_