Subscribe2 – Form, Email Subscribers & Newsletters
Subscribe2 – Form, Email Subscribers & Newsletters has 12 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2026; 11 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 5.6, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 4 high. 2026 was the busiest year with 3 disclosures.
The most common weakness is Cross-Site Scripting, behind 5 of the records (42%). Other recurring categories include Missing Authorization, Cross-Site Request Forgery (CSRF).
11 of the records (92%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.
10 independent researchers contributed these findings, most of them (2) reported by Marco Wotschka. Subscribe2 – Form, Email Subscribers & Newsletters is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2026-73393Subscribe2 – Form, Email Subscribers & Newsletters <= 10.46 - Unauthenticated Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Subscribe2 – Form, Email Subscribers & Newsletters
Author
weDevs
Summary Subscribe2 provides a comprehensive subscription management and email notification system for WordPress blogs that sends email notifications to a list of subscribers when you publish new content to your blog. A full description of features is below. Email Email notifications can be sent on a per-post basis or periodically in a Digest email. Additionally, certain categories can be excluded from inclusion in the notification and posts can be excluded on an individual basis by setting a custom field. Subscriptions Subscription requests allows users to publicly subscribe (Public Subscribers) by submitting their email address in an easy to use form or to register with your blog (Registered Users) which enables greater flexibility over the email content for per-post notifications for the subscriber. Admins are given control over the presentation of the email notifications, can bulk manage subscriptions for users and manually send email notices to subscribers. The format of the email can also be customised for per-post notifications, Subscribe2 can generate emails for each of the following formats: plaintext excerpt. plaintext full post (Registered Users only). HTML excerpt (Registered Users only). HTML full post (Registered Users only). If you want to grow your subscriber lists, send automated campaigns to huge subscriber lists, you should upgrade to weMail. Privacy Policy Subscribe2 uses Appsero SDK to collect some telemetry data upon user’s confirmation. This helps us to troubleshoot problems faster & make product improvements. Learn more about how Appsero collects and uses this data.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C