The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a page embedding the form, including logged-out visitors and administrators.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Wp Subscribe Form Plugin | — | Update wp-subscribe-form plugin to version 1.6.3, or a newer patched version | Oct 30, 2026 | Sep 21, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub