Veille CVE

Recherche « Unknown Subscribe to Comments »

6 CVE

Critique 0 Élevée 1 Moyenne 4 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Subscribe to Comments » ✕
  1. CVE-2026-91831 3.8 Faible

    Unknown Subscribe to Comments

    The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.

  2. CVE-2026-91830 6.5 Moyenne

    Unknown Subscribe to Comments

    The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions.

  3. CVE-2026-107791 6.5 Moyenne

    Unknown WP Comment Cleaner

    The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.

  4. CVE-2026-91829 7.1 Élevée

    Unknown Subscribe to Comments

    The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators.

  5. CVE-2026-85572 4.3 Moyenne

    Unknown Tutor LMS

    The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation.

  6. CVE-2026-12273 4.3 Moyenne

    Unknown Tutor LMS

    The Tutor LMS WordPress plugin before 3.9.13 does not perform any authorization or post-target validation before creating a comment in one of its handlers, and stores the comment pre-approved, allowing authenticated users with subscriber-level access and above to post auto-approved comments containing arbitrary HTML and links on any content across the site, bypassing the comment moderation queue.