CVE-2026-103422: AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter
The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in AnyCommentSubscriptionsTable::columndefault(), which returns the stored email verbatim into an HTML <td> when the subscription's userID does not resolve to an existing WPUser. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the AnyComment → Subscriptions admin page.
Affected Software
Event History
Frequently Asked Questions
Which sites and users are exposed to this issue?
WordPress sites using AnyComment version 0.3.6 or earlier are affected. The injected script is intended to execute in the browser of an administrator who opens the AnyComment Subscriptions admin page.
Does exploitation require an account or user interaction from the attacker?
No. An attacker can submit a crafted email value to the public /wp-json/anycomment/v1/subscribe REST endpoint without authentication or privileges.
Under what condition will a stored payload be rendered in the administration interface?
The stored email is returned verbatim in an HTML table cell when the subscription's user_ID does not resolve to an existing WordPress user. An administrator must then access the AnyComment Subscriptions page for the script to execute.