Security Alert Summary
The Subscribe Forms WordPress plugin prior to version 1.6.3 contains a stored cross-site scripting (XSS) vulnerability. The plugin fails to properly sanitize and escape a form setting before output, allowing authenticated users with the Author role and above to inject script that will execute in the browser of any visitor who views a page embedding the affected form, including logged-out visitors and administrators.
CVE Details
- CVE ID:
CVE-2026-91073 - Affected component: Subscribe Forms WordPress plugin
- Affected versions: Versions before 1.6.3 (example listed: 1.4.1)
- Published: September 23, 2026 at 6:17:05 AM UTC
- Last modified: September 23, 2026 at 11:17:17 AM UTC
- CVSS v3.1: Base score 6.8, MEDIUM; vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H - Authentication / privileges / user interaction: Requires an authenticated user with elevated privileges (privileges required: HIGH). The plugin allows exploitation by users with the Author role and above. User interaction is required.
- Primary impact: Confidentiality: HIGH; Integrity: HIGH; Availability: HIGH
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)
Technical Details
The vulnerability is a stored cross-site scripting (XSS) issue caused by the plugin not sanitising and escaping one of its form settings before outputting that setting into a page. Because the unsafe value is stored in the form configuration and then rendered on pages that embed the form, an authenticated user with sufficient privileges (Author or higher) can save malicious script into that setting.
When a visitor views a page containing the affected form, the injected script can execute in the visitor’s browser. The CVE description specifies the missing sanitisation/escaping of a form setting but does not name specific functions or REST endpoints. The core issue is output encoding and input validation not being applied to a setting that is persisted and later rendered.
Impact is limited to the contexts where the form and its settings are rendered. The exploit enables script execution in the context of the site for any visitor that loads the page, which can be used to steal session data presented to the browser, perform actions available to that user in the UI, or carry out other browser-based attacks consistent with stored XSS.
How This Could Impact Your Website
Consider a site with multiple WordPress users: the site owner, internal content editors, and an external contractor who has Author-level access to create or edit forms. If an Author-level user were to save a malicious value into the affected form setting, every visitor who loads a page with that embedded form could have script run in their browser.
Practical consequences include exposure of data visible to the browser (for example, session tokens presented to the browser), the potential capture of user-visible information, and an increased risk of targeted phishing or social engineering if attackers harvest or infer user details. Logged-out visitors and administrators who view affected pages are also at risk of having scripts execute in their browsers, depending on what the injected script attempts.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially Author-level access for external contributors.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and logs for unusual behavior or unexpected form changes.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
