CVE-2026-91073: Subscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form Setting
The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a page embedding the form, including logged-out visitors and administrators.
Affected Software
Event History
Frequently Asked Questions
Which users and visitors are exposed to this issue?
Authenticated users with the Author role or higher can inject the stored script through the affected form setting. The script runs for any visitor viewing a page that embeds the form, including logged-out users and administrators.
What plugin versions are affected, and what version addresses the issue?
Versions 1.4.1 through 1.6.2 are affected. The issue is fixed in version 1.6.3 or later.
What conditions are required for exploitation?
An attacker needs an authenticated WordPress account with at least the Author role and access to configure the affected form setting. A page must embed the malicious form for its visitors to execute the stored script.