EUVD-2026-100779

The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in...

CVE-2026-103422 AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter

The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in...

CVE-2026-103422

The AnyComment plugin for WordPress (versions up to and including 0.3.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw stems from insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and a lack of output escaping in the AnyCommentSubscripti...