The vulnerability resides in the WordPress Subscribe Forms plugin, versions 1.4.1 through 1.6.2. An input field in one of the form settings is not properly sanitized or escaped before being rendered on a page. This flaw permits a logged‑in user with the Author role or above to inject arbitrary script that is stored in the form configuration and later executed in any visitor’s browser when the form is displayed, including administrators and anonymous users. The attack results in malicious script execution, potentially leading to credential theft, defacement, or further session hijacking.

WordPress sites that have the Subscribe Forms plugin installed in vulnerable releases, specifically 1.4.1 to 1.6.2. The vendor is not listed, but the plugin can be identified by the name Subscribe Forms. Sites using the plugin with any of these versions are affected until a patch is applied.

The flaw carries a CVSS score of 6.8, indicating moderate severity. The EPSS score is reported as less than 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated with Author privileges or higher to exploit the flaw; the stored nature of the payload then affects every page that embeds the compromised form. There is no public exploitation of this vulnerability has been reported, but the placement of malicious code in all page visitors’ browsers represents a serious threat for sites with active author contributors.