CVE-2026-91073

Name of the Vulnerable Software and Affected Versions Subscribe Forms versions prior to 1.6.3

Description Stored Cross-Site Scripting (XSS) occurs because the plugin fails to sanitize and escape a form setting before it is output on a page. This allows authenticated users with the Author role or higher to inject malicious scripts that execute in the browser of any visitor viewing the page containing the form, including administrators and unauthenticated users.

Recommendations Update Subscribe Forms to version 1.6.3 or later.