The plugin does not properly validate or sanitize the ‘ref’ query parameter before reflecting it in a link target. This allows an unauthenticated attacker to create a crafted URL that, when clicked by any user, executes arbitrary JavaScript in the victim’s browser. The attack can compromise confidentiality, integrity, and availability of user sessions and can be used to deface the site or redirect users to malicious destinations.

Because the vulnerability exists in all versions of the Subscribe to Comments WordPress plugin prior to 2.3.3, any WordPress installation that has the plugin installed and not yet updated is affected. The plugin is not tied to a recognized vendor in the CNA list, so administrators must review their WordPress instances for the presence of this plugin and verify that the installed version is newer than 2.3.3.

The EPSS score of less than 1% indicates a low probability of exploitation, although reflected XSS vulnerabilities can still be leveraged via social engineering. The vulnerability is listed in CISA KEV as not present, but the absence of an official advisory does not reduce its risk. The attack vector is reflected XSS via an HTTPS or HTTP link that an attacker can send to any user, including administrators, making the likelihood of exploitation significant in an environment where social engineering or malicious links are possible. The CVSS score of 7.1 indicates high severity, but the potential for privilege abuse and data theft is high.