Plugins · subscribe2 · data as of 2026-11-04
Is Subscribe2 safe? Known vulnerabilities and latest version
- Latest version
- 10.48
- Last updated
- 2026-09-23
- Active installs
- 10,000+
- Known issues on record
- 8
- Unpatched in latest
- 0
- Tested up to WP
- 7.0.8 · PHP 5.4+
Sends a list of subscribers an email notification when you publish new posts. — by weDevs
What to do
- Update to the latest version (10.48). Anything older than 10.47 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
- If you cannot update right away, deactivate it until you can.
- Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
- If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.
With WP-CLI: wp plugin get subscribe2 --field=version shows what you run; wp plugin update subscribe2 updates it.
Check your version
Known vulnerabilities
8 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.
high 7.1 CVE-2026-73393 · published 2026-08-18
Cross-site scripting (XSS) in Subscribe2 (10.46 and older)
- Affected
- 10.46 and older
- Fixed in
- 10.47 *
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.
medium 6.1 CVE-2026-14331 · published 2026-08-07
Reflected cross-site scripting (XSS) in Subscribe2 (older than 10.46)
- Affected
- older than 10.46
- Fixed in
- 10.46
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- CVE record (the advisory publisher) · score by CISA ADP
Details from the advisory
The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link.
medium 6.5 CVE-2026-24944 · published 2026-02-20
Missing authorization check in Subscribe2 (10.44 and older)
- Affected
- 10.44 and older
- Fixed in
- 10.45
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Missing Authorization vulnerability in weDevs Subscribe2 subscribe2 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Subscribe2: from n/a through <= 10.44.
high 7.2 CVE-2024-11582 · published 2025-02-19
Stored cross-site scripting (XSS) in Subscribe2 (10.43 and older)
- Affected
- 10.43 and older
- Fixed in
- 10.44 *
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The Subscribe2 – Form, Email Subscribers & Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ip parameter in all versions up to, and including, 10.43 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
medium 4.3 CVE-2023-1844 · published 2023-06-28
Missing authorization check in Subscribe2 (10.40 and older)
- Affected
- 10.40 and older
- Fixed in
- 10.41 *
- Access needed (per CVSS)
- Needs a low-level account (e.g. subscriber)
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The Subscribe2 plugin for WordPress is vulnerable to unauthorized access to email functionality due to a missing capability check when sending test emails in versions up to, and including, 10.40. This makes it possible for author-level attackers to send emails with arbitrary content and attachments to site users.
NVD CVE-2023-1844Wordfence advisoryCode change (fix)Plugin source
medium 4.3 CVE-2023-3407 · published 2023-06-28
Cross-site request forgery (CSRF) in Subscribe2 (10.40 and older)
- Affected
- 10.40 and older
- Fixed in
- 10.41 *
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- CVE record (the advisory publisher) · score by NVD
Details from the advisory
The Subscribe2 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.40. This is due to missing or incorrect nonce validation when sending test emails. This makes it possible for unauthenticated attackers to send test emails with custom content to users on sites running a vulnerable version of this plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD CVE-2023-3407Wordfence advisoryCode change (fix)Plugin source
low 3.1 CVE-2022-4309 · published 2023-01-16
Cross-site request forgery (CSRF) in Subscribe2 (older than 10.38)
- Affected
- older than 10.38
- Fixed in
- 10.38
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- CVE record (the advisory publisher) · score by NVD
Details from the advisory
The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete arbitrary users by knowing their email via a CSRF attack.
medium 6.1 CVE-2014-6604 · published 2018-03-29
Cross-site scripting (XSS) in Subscribe2 (older than 10.16)
- Affected
- older than 10.16
- Fixed in
- 10.16
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- NVD analysis · score by NVD
Details from the advisory
Cross-site scripting (XSS) vulnerability in class-s2-list-table.php in the Subscribe2 plugin before 10.16 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ip parameter.
Recent activity
- 2026-09-23 — latest release on wordpress.org (10.48).
- 2026-08-18 — Cross-site scripting (XSS) disclosed (CVE-2026-73393), fixed in 10.47.
- 2026-08-07 — Reflected cross-site scripting (XSS) disclosed (CVE-2026-14331), fixed in 10.46.
- 2026-02-20 — Missing authorization check disclosed (CVE-2026-24944), fixed in 10.45.
Get an email when Subscribe2 has a new vulnerability
Free. We check the CVE feeds every day and email you only when a new issue for Subscribe2 (subscribe2) is published or a fix ships. Unsubscribe in one click.
Browse vulnerabilities
- Published this week
- Unpatched in the latest version
- By type of vulnerability
- Plugins by weDevs (7 tracked)
Types found in this plugin: Cross-site scripting (XSS) (4) · Missing authorization (2) · Cross-site request forgery (CSRF) (2)
Where this data comes from
- Version, last update, installs: wordpress.org/plugins/subscribe2 (Plugins API), fetched 2026-11-04.
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.
Badge for your site or docs (states facts with a date, not a verdict):
<a href="https://laskyr.com/plugins/subscribe2"><img src="https://laskyr.com/plugins/subscribe2/badge.svg" alt="Subscribe2 vulnerability status"></a>