CVE-2026-73393: WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability

Q: Which installations should be considered exposed?

Sites using Subscribe2 version 10.46 or earlier are affected according to the available information. The data does not identify a fixed version, so verify the installed plugin version and consult the vendor reference before upgrading.

Q: What does an attacker need to exploit this issue?

The vulnerability is unauthenticated and network-reachable, so an attacker does not need a WordPress account or prior privileges. Exploitation requires user interaction, as indicated by the UI:R vector.

Published Aug 18, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.

Affected Software

1 affected component

WordPress Subscribe2 plugin<=10.46

Event History

Aug 18, 2026

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations should be considered exposed?

Sites using Subscribe2 version 10.46 or earlier are affected according to the available information. The data does not identify a fixed version, so verify the installed plugin version and consult the vendor reference before upgrading.

What does an attacker need to exploit this issue?