Description
The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Subscribe to Comments | < 2.3.3 | 2.3.3 |
References
- https://wpscan.com/vulnerability/1ed0314d-9871-4914-bb9c-ff894ea4c400/ exploit vdb-entry technical-description