Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-91073— Subscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form Setting

Quick assessment

Affected

Unknown Subscribe Forms

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 WordPress 插件 Subscribe Forms 1.6.3 之前的版本中，插件未对其某个表单设置进行过滤和转义就直接输出到页面中，这使得拥有“作者”及更高权限的认证用户可以执行存储型跨站脚本攻击（Stored Cross-Site Scripting, XSS）。当任何访客（包括已登出用户和管理员）查看嵌入了该表单的页面时，攻击者注入的恶意脚本将在其浏览器中执行。

AI Predicted 6.1 Difficulty: Easy EPSS 0.43% · P38 Updated Sep 23, 2026

Possible ATT&CK Techniques 1 AI

T1059.007 · JavaScript

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Unknown	Subscribe Forms	`1.4.1< 1.6.3`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Subscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form Setting

Source: CVE Program / CVE List V5

Vulnerability Description

The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a page embedding the form, including logged-out visitors and administrators.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	Subscribe Forms	1.4.1 ~ 1.6.3	-

II. Public POCs for CVE-2026-91073

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-91073

请登录查看更多情报信息。

Other References for CVE-2026-91073 (1)

https://wpscan.com/vulnerability/50d0d5b6-2204-4af3-92d5-75085ce2f176/ exploit vdb-entry technical-description

https://www.cve.org/CVERecord?id=CVE-2026-91073

Same Patch Batch · Unknown · 2026-09-23 · 57 CVEs total

CVE-2026-86601	6.5 MEDIUM	WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Conte
CVE-2026-86612	5.6 MEDIUM	Ninja Tables < 5.2.17 - Unauthenticated Arbitrary Shortcode Execution via Fluent Forms Dat
CVE-2026-84091	5.3 MEDIUM	SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forge
CVE-2026-90950	5.3 MEDIUM	Paid Member Subscriptions < 3.1.0 - Unauthenticated reCAPTCHA Bypass via Registration Form
CVE-2026-87978	5.3 MEDIUM	Paymob for WooCommerce < 4.1.14 - Unauthenticated Payment Bypass via Unverified Subscripti
CVE-2026-87071	5.3 MEDIUM	Forminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts
CVE-2026-87070	5.3 MEDIUM	Forminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofing
CVE-2026-86604	4.8 MEDIUM	GTranslate < 5.0.1 - Unauthenticated Arbitrary Shortcode Execution via Email Translation
CVE-2026-87848	3.7 LOW	MPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Non-Public Post Content Disclosure
CVE-2026-93511		Premium Packages < 7.2.1 - Unauthenticated PayPal Webhook Signature Verification Bypass
CVE-2026-86842		Real3D Flipbook Lite < 5.4 - Author+ Content Deletion and Stored XSS via Global Settings O
CVE-2026-91024		Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid)
CVE-2026-89331		FluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Pub
CVE-2026-88997		JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key
CVE-2026-87981		Paymob for WooCommerce < 4.1.14 - Contributor+ Payment Gateway Configuration Deletion and
CVE-2026-87074		Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attac
CVE-2026-87979		Paymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via W
CVE-2026-88929		Sale Booster 7.0.0 - 7.5.1 - Unauthenticated Non-Public Product Disclosure
CVE-2026-87069		Forminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe
CVE-2026-86783		PostX < 5.0.41 - Unauthenticated Custom Field Key Disclosure via REST API

Showing top 20 of 57 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same vendor: Unknown