CVE-2026-120531: Stored XSS in Subscribe2
CVE-2026-120531 is an unauthenticated stored cross-site scripting flaw in the Subscribe2 – Form, Email Subscribers & Newsletters WordPress plugin. It was published on November 7, 2026 via Wordfence. Insufficient input sanitization and output escaping on the data[ip] parameter let an unauthenticated attacker store script that runs whenever someone opens the affected page, typically an administrator reviewing subscriber data.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-120531 |
| Plugin | Subscribe2 – Form, Email Subscribers & Newsletters |
| Affected versions | All versions up to and including 10.47 |
| Weakness | Stored XSS (CWE-79) |
| CVSS v3.1 | 7.2 (High), AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
| Authentication | None required |
| Exploitation | No known exploitation; not in CISA KEV |
| CNA | Wordfence |
Wordfence reports the issue was found on May 31, 2026 and the vendor was notified on October 29, 2026. NVD lists the record as deferred, so scoring may change.
Impact
Because the payload is stored and the scope changes, injected script executes in the browser of a higher-privileged user. Typical outcomes are session theft, forced admin actions such as creating rogue accounts, or redirects to malicious sites.
Patch Status
Sources differ. VulDB points to version 10.48 or later, and NVD references a WordPress plugin changeset (3709549) that is likely the fix. Another tracker leaves the fixed version blank. Verify the version your site is running in the WordPress dashboard and confirm against the Wordfence advisory.
Recommended Actions
- Update Subscribe2 to the latest release (10.48 or later).
- If no fix is available to you, deactivate and remove the plugin.
- Put a WAF rule in front of the site to filter script payloads in the
data[ip]parameter. - Review subscriber records for entries containing HTML or script tags and clean them.
- Review admin accounts for unexpected additions.