CVE-2026-91073 in Subscribe Forms Plugin
Summary
by MITRE • 09/23/2026
The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a page embedding the form, including logged-out visitors and administrators.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The Subscribe Forms plugin for WordPress, prior to version 1.6.3, contains a critical input validation flaw rooted in insufficient sanitization and escaping mechanisms within its configuration handling logic. This vulnerability specifically affects one of the form settings that is rendered directly into web pages without proper encoding or filtering. The core technical issue lies in the failure to apply appropriate output escaping functions such as esc_html or wp_kses_post before injecting user-supplied data into the HTML context. By neglecting these essential security controls, the application allows raw input containing executable script tags and event handlers to persist within the page source code when a form is embedded. This represents a classic instance of improper neutralization of special elements used in an output context, which fundamentally breaks the separation between content and execution expected by web browsers.
The operational impact of this flaw is significant due to its classification as a Stored Cross-Site Scripting vulnerability with broad accessibility criteria. Unlike reflected XSS attacks that require tricking users into clicking malicious links, stored vulnerabilities persist on the server side or in the database until retrieved. In this case, any authenticated user possessing an Author role or higher can inject malicious payloads by modifying the vulnerable form setting. Once saved, these scripts are permanently stored and served to every visitor who loads a page containing that specific form. This includes unauthenticated visitors as well as high-privilege administrators, creating a widespread attack surface where a single compromised low-level account can lead to full session hijacking or administrative takeover across the entire site ecosystem. The persistence of the payload ensures continuous exploitation potential until the malicious setting is manually corrected by an administrator who may also fall victim to their own script execution.
From a threat modeling perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The attack vector leverages the browser's default behavior of executing JavaScript embedded in HTML responses, allowing attackers to steal session cookies, capture sensitive form data entered by users, or perform actions on behalf of victims such as changing passwords or making purchases if e-commerce functionality is present. Furthermore, this scenario maps directly to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically under the sub-technique for JavaScript execution within a web browser context. The ability to execute arbitrary code in the victim's environment facilitates further lateral movement or data exfiltration campaigns that extend beyond simple defacement into serious privacy breaches and financial fraud.
Mitigation strategies must prioritize immediate patching of the Subscribe Forms plugin to version 1.6.3 or later, where these input validation issues have been addressed by developers through rigorous sanitization protocols. For organizations unable to update immediately due to compatibility constraints, implementing a Web Application Firewall rule that detects and blocks common XSS payloads in form submission fields can provide temporary protection against exploitation attempts. Additionally, enforcing strict Content Security Policy headers on the WordPress site can significantly reduce the impact of successful injection attacks by restricting script execution sources and preventing inline scripts from running unless explicitly whitelisted. Regular security audits focusing on input handling across all plugins are essential to identify similar patterns of inadequate escaping that could lead to other stored or reflected XSS vulnerabilities within the application stack.