Veille CVE

Recherche « Unknown Subscribe to Comments »

4 CVE

Critique 0 Élevée 1 Moyenne 2 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Subscribe to Comments » ✕
  1. CVE-2026-91831 3.8 Faible

    Unknown Subscribe to Comments

    The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.

  2. CVE-2026-91830 6.5 Moyenne

    Unknown Subscribe to Comments

    The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions.

  3. CVE-2026-107791 6.5 Moyenne

    Unknown WP Comment Cleaner

    The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.

  4. CVE-2026-91829 7.1 Élevée

    Unknown Subscribe to Comments

    The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators.