{"id":"CVE-2026-91831","revision":"ff630fa7de5c4551a0b1797fb491cf35","records":[{"revision":"ff630fa7de5c4551a0b1797fb491cf35","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-91831","aliases":[],"title":"Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting","description":"The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.","state":0,"publishedAt":"2026-10-19T06:46:17.28+00:00","modifiedAt":"2026-10-19T09:31:21.214+00:00","affected":[{"ecosystem":"https://wordpress.org/plugins","name":"Subscribe to Comments","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"Subscribe to Comments\",\n                    \"collectionURL\": \"https://wordpress.org/plugins\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"2.3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"2.3.3\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","score":3.8,"severity":"LOW"}],"references":["https://wpscan.com/vulnerability/6cd60f78-f5e2-4b4a-8d50-7d2bc4f981ee/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-91831","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-91831","identifiers":["CVE-2026-91831"]},"retained":false,"historicalAffected":[]}],"coverage":[]}