CVE-2026-103422

🗓️ 14 Oct 2026 02:27:38Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 27 Views🌐 WEB

Unauthenticated Stored XSS in AnyComment for WordPress via 'email' parameter.

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2026-103422	14 Oct 202616:24	–	circl
Cvelist	CVE-2026-103422 AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter	14 Oct 202602:27	–	cvelist
EUVD	EUVD-2026-100779	14 Oct 202602:27	–	euvd
NVD	CVE-2026-103422	14 Oct 202603:17	–	nvd
Patchstack	WordPress AnyComment plugin <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting vulnerability	13 Oct 202615:02	–	patchstack
Positive Technologies	PT-2026-113603	14 Oct 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-103422: Improper Neutralization of Input During Web Page Generation	14 Oct 202600:00	–	rapid7
Vulnrichment	CVE-2026-103422 AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter	14 Oct 202602:27	–	vulnrichment

Vulners

Node

bologer anycommentRange≤0.3.6wordpress

[
  {
    "vendor": "ateshabaev",
    "product": "AnyComment",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "0.3.6",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/anycomment/tags/0.3.6/includes/Rest/AnyCommentRestSubscriptions.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/ce925d1c-2254-49ea-9fcf-e948813b3f2c
plugins	www.plugins.trac.wordpress.org/browser/anycomment/tags/0.3.6/includes/Admin/Tables/AnyCommentSubscriptionsTable.php
plugins	www.plugins.trac.wordpress.org/browser/anycomment/tags/0.3.6/includes/Rest/AnyCommentRestSubscriptions.php
plugins	www.plugins.trac.wordpress.org/browser/anycomment/tags/0.3.6/includes/Models/AnyCommentSubscriptions.php

Parameter	Position	Path	Description	CWE
email	request body	/wp-json/anycomment/v1/subscribe	Stored Cross-Site Scripting (XSS) via the 'email' parameter in the subscribe REST endpoint. The input is not properly sanitized and is later rendered without escaping in the admin dashboard.	CWE-79

14 Oct 2026 15:17Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.17.2

EPSS0.00309

SSVC

CWE-79