CVE-2026-103422 ateshabaev CVE debrief

Who should care

Administrators and security teams responsible for WordPress installations with the AnyComment plugin should assess exposure and prioritize verification and potential updates to prevent exploitation. They should also review and adjust input sanitization and output escaping in the AnyComment plugin, and monitor for potential exploitation attempts.

Why it matters

The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts, which can execute when an administrator accesses the AnyComment → Subscriptions admin page. Administrators and security teams responsible for WordPress installations with the AnyComment plugin should assess exposure and prioritize verification and potential updates.

• Unauthenticated attackers can inject arbitrary web scripts in pages that will execute whenever an administrator accesses the AnyComment → Subscriptions admin page
• Administrators and security teams must verify and update the AnyComment plugin to a fixed version, if available
• Input sanitization and output escaping in the AnyComment plugin require review and adjustment

Technical summary

The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in AnyCommentSubscriptionsTable::column_default(). The vulnerability allows unauthenticated attackers to inject arbitrary web scripts, which can execute when an administrator accesses the AnyComment → Subscriptions admin page, potentially leading to unauthorized actions or data breaches.

Defensive priority

Administrators and security teams should prioritize verifying and updating the AnyComment plugin to a fixed version, if available, and monitor for potential exploitation attempts.

Recommended defensive actions

• Verify and update the AnyComment plugin to a fixed version, if available
• Monitor for potential exploitation attempts
• Review and adjust input sanitization and output escaping in the AnyComment plugin
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected version and the lack of input sanitization and output escaping. The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts, which can execute when an administrator accesses the AnyComment → Subscriptions admin page. Evidence is limited to public CVE details and source item.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.