The WordPress plugin Subscribe2 – Form, Email Subscribers & Newsletters contains an unauthenticated stored cross‑site scripting flaw. The flaw resides in the ‘data[ip]’ parameter, which is not properly sanitized or escaped. The result is that an attacker can embed arbitrary JavaScript into the plugin’s storage, which will run whenever any user loads a page that reflects that data. This weakness grants the ability to corrupt the user’s browser session, steal cookies, or deface content, and is classified as CWE‑79.

The vulnerability affects all releases of Subscribe2 – Form, Email Subscribers & Newsletters up to and including version 10.47, distributed by wedevs for WordPress. Any WordPress site using a version in this range is potentially exposed.

With a CVSS score of 7.2 the flaw presents a moderate to high risk. No EPSS score is published, and the vulnerability is not listed in CISA’s KEV catalogue, suggesting it has not yet been widely exploited in the wild. Attackers can achieve the exploit without authentication, and the stored payload will persist until the plugin data is cleaned or the plugin is upgraded. The simplest exploitation path is to submit the malicious script via the exposed parameter and then lure or wait for site visitors to load the affected content.