The AnyComment plugin for WordPress is vulnerable to unauthenticated stored Cross‑Site Scripting through the email parameter on its public /wp-json/anycomment/v1/subscribe REST endpoint. Because input is not sanitized and output is not escaped, an attacker can inject malicious JavaScript that is later rendered when an administrator opens the AnyComment → Subscriptions admin page. This allows the attacker to execute arbitrary scripts in the administrator's browser session, potentially leading to session hijacking, credential theft, defacement, or other malicious actions performed under the administrator’s authority.

The vulnerability affects the AnyComment plugin version 0.3.6 and earlier for WordPress. The vendor is ateshabaev:AnyComment.

The CVSS score of 7.2 indicates a high severity. The EPSS score of less than 1% indicates that the likelihood of exploitation is very low at this time. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit it simply by sending an unauthenticated request to the /wp-json/anycomment/v1/subscribe endpoint with a crafted email value; no authentication or privileged access is required. If exploited, scripts would run whenever a user with administrative privileges visits the Subscriptions admin page. This raises the attack surface for privileged accounts and could allow persistent, script‑based sabotage.