Subscribe2 < 10.46 – Reflected XSS via email Parameter | CVE 2026-14331

Description

The plugin does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link.

Proof of Concept

Prerequisites: a published page or post containing the [subscribe2] shortcode (default plugin output, no configuration change). The vulnerable form is rendered only to logged-out visitors.

1. As an unauthenticated visitor, open a crafted URL on that page, supplying the payload in the email query parameter (a real mail domain such as gmail.com is required so the value passes the plugin's email/DNS validation):

https://victim.example/<post-slug>/?email=x'||alert`3l5h0pky`||'@gmail.com

2. Click/focus the email input field. The injected JavaScript executes via the field's onfocus handler.

The value is reflected without escaping inside the inline onfocus/onblur handlers (the value= attribute is esc_attr-escaped, the handlers are not), so 'x' closes the JS string and ||alert`3l5h0pky`|| runs as a tagged-template call.