Stored Cross-Site Scripting Vulnerability in AnyComment Plugin for WordPress

CVE-2026-103422

What is CVE-2026-103422?

The AnyComment plugin for WordPress is susceptible to a vulnerability that allows for Stored Cross-Site Scripting through the 'email' parameter. If exploited, unauthenticated attackers can inject malicious scripts via the public /wp-json/anycomment/v1/subscribe REST endpoint. This issue arises from inadequate input sanitization and the lack of output escaping in the code responsible for rendering subscription data in the admin panel, specifically when the user_ID does not match an existing WordPress user. Consequently, these injected scripts can execute whenever an administrator accesses the AnyComment Subscriptions admin page, posing significant risks to site security.

References