Stored Cross-Site Scripting in Subscribe Forms Plugin for WordPress
CVE-2026-91073
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 23 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-91073?
The Subscribe Forms WordPress plugin prior to version 1.6.3 fails to properly sanitize and escape form settings before rendering them on web pages. This oversight allows authenticated users with the Author role and higher to exploit the vulnerability and perform stored cross-site scripting attacks. These attacks can affect any visitor, including those who are logged out and administrators, as malicious scripts execute in the browsers of these users when they view pages containing the compromised form.
Affected Version(s)
Subscribe Forms 1.4.1 < 1.6.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.