What the vulnerability does
01Description
A vulnerability, which was classified as problematic, was found in Subscribe to Comments Plugin up to 2.0.7 on WordPress. This affects an unknown part of the file subscribe-to-comments.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.0.8 is able to address this issue. The identifier of the patch is 9683bdf462fcac2f32b33be98f0b96497fbd1bb6. It is recommended to upgrade the affected component. The identifier VDB-222321 was assigned to this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
The Subscribe to Comments Plugin contains a stored cross-site scripting (XSS) vulnerability in versions 2.0.0 and earlier. An authenticated user with low privileges can inject malicious scripts that execute in other users' browsers when they view affected pages. The vulnerability requires user interaction to trigger. This allows attackers to steal session tokens, redirect users, or deface content.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that run in other users' browsers to steal data or redirect them.
Potential impact on your site
04Site Impact
Authenticated users can inject scripts affecting other site visitors; session hijacking and data theft are possible.
Conditions required to exploit
05Prerequisites
Attacker must be logged in with low-level user privileges; victim must view the affected page.
Key dates
06Disclosure timeline
March 5, 2023
CVE published
August 7, 2024
Record updated
