CVE-2026-120531

Description

The Subscribe2 – Form, Email Subscribers & Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data[ip]’ parameter in all versions up to, and including, 10.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Overview

State: PUBLISHED
Assigner (CNA): Wordfence
CVSS severity: HIGH
CVSS score: 7.2 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Effective score: 7.2 / 10 HIGH source: CNA overview
CWE(s): CWE-79
Reserved: 2026-11-02
Published: 2026-11-07 21:24 UTC
Last updated: 2026-11-07 21:24 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120531.json
Linked Threat: CVE-2026-120531 — Subscribe2 – Form, Email Subscribers & Newsletters <= 10.47 - Unauthenticated Stored Cross-Site Scripting via 'data[ip]' Parameter

Affected products (1)

Vendor	Product	Versions	Platforms
wedevs	Subscribe2 – Form, Email Subscribers & Newsletters	`0` (affected)	—

Vendor references (2)

References embedded in the original CVE record by the assigning CNA.

MITRE references (2) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Indicators (1)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
cve	`CVE-2026-120531`	no local data	2026-11-07 11:08 UTC

Remediations (9)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

CVEs and Security Vulnerabilities - OpenCVE

web:app.opencve.io

Explore the latest vulnerabilities and security issues in the CVE database

2026-11-07 11:08 UTC
CVE Vulnerabilities 2026: Critical Flaws & Fixes Hub

web:cyberupdates365.com

Track critical CVE vulnerabilities 2026 with verified enterprise patch guides. Fix zero-days across VMware, WordPress, Windows, and cloud infrastructure.

2026-11-07 11:08 UTC
CVE 2026 | The Complete Guide to New, Critical & Actively Exploited ...

web:malware.news

Google specifically recommends sandboxing agentic workloads and moving to risk-based triage. How to Fix and Prioritize CVE 2026 Vulnerabilities Fix CVE-2026 vulnerabilities by patching exploited and internet-exposed systems first, applying vendor mitigations where a patch lags, and ranking everything else using CVSS, EPSS, and KEV together.

2026-11-07 11:08 UTC
NVD - Search

web:nvd.nist.gov

Search Please make use of the interactive search interfaces to find information in the database!

2026-11-07 11:08 UTC
ArcGIS Server Security 2026 Update 4 Patch - Esri Support

web:support.esri.com

The issues resolved by these patches are listed in the Issues addressed with this patch section below. As part of the patch installation, the ArcGIS Server service is stopped and restarted. The restart may take several minutes depending on the number of services published on the ArcGIS Server site. This patch can be uninstalled as outlined in the Uninstalling this patch on Windows and ...

2026-11-07 11:08 UTC
CISA: Ransomware Now Exploits Critical VMware vCenter Bug

web:tech-insider.org

CISA confirms ransomware gangs are exploiting CVE - 2026 -59310, a CVSS 9.8 VMware vCenter RCE flaw. Patch details, KEV deadline, and fixes inside.

2026-11-07 11:08 UTC
CVE-2026-59310 VMware vCenter RCE Analysis & Mitigation - Vali Cyber

web:valicyber.com

Vali Cyber analyzes CVE - 2026 -59310, a critical VMware vCenter vulnerability enabling unauthenticated root compromise and active attacks.

2026-11-07 11:08 UTC
Oracle Critical Security Patch Update Advisory - September 2026

web:www.oracle.com

Prior Critical Patch Update and Critical Security Patch Update advisories should be reviewed for information regarding earlier published security patches. Refer to Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins for information about Oracle Security advisories.

2026-11-07 11:08 UTC
Wordfence remediation: Subscribe2 – Form, Email Subscribers & Newsletters

Wordfence

Update to version 10.48, or a newer patched version

2026-11-07 11:08 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-120531.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Subscribe2 \u2013 Form, Email Subscribers & Newsletters",
          "vendor": "wedevs",
          "versions": [
            {
              "lessThanOrEqual": "10.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Naoya Takahashi (nakko)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Subscribe2 \u2013 Form, Email Subscribers & Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018data[ip]\u2019 parameter in all versions up to, and including, 10.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T21:24:08.525Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9aa4bcc1-3c9e-451e-81ed-2059882b2ef1?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3709549/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-31T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2026-10-29T04:42:02.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-07T08:27:42.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Subscribe2 \u2013 Form, Email Subscribers & Newsletters <= 10.47 - Unauthenticated Stored Cross-Site Scripting via 'data[ip]' Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-120531",
    "datePublished": "2026-11-07T21:24:08.525Z",
    "dateReserved": "2026-11-02T16:19:23.937Z",
    "dateUpdated": "2026-11-07T21:24:08.525Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}