{"schema":"threatline.record/2","record":{"id":"CVE-2026-91831","aliases":[],"summary":"Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting","details":"The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.","categories":["Unclassified"],"product":"Subscribe to Comments","vendor":"Unknown","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91831","source_modified_at":"2026-10-19T09:31:21.214Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Subscribe to Comments","vendor":"Unknown","versions":[{"version":"2.3","status":"affected","versionType":"semver","lessThan":"2.3.3"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91831","source_modified_at":"2026-10-19T09:31:21.214Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Subscribe to Comments","ecosystem":null},"version":"2.3.3","basis":"first unaffected version stated in the CVE record"}],"cvss":3.8,"severity":"Low","kev":{"listed":false},"epss":{"probability":0.00161,"percentile":0.04925,"score_date":"2026-10-23"},"published_at":"2026-10-19T06:46:17.280Z","modified_at":"2026-10-19T09:31:21.214Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-91831","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T09:31:21.214Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91831","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://wpscan.com/vulnerability/6cd60f78-f5e2-4b4a-8d50-7d2bc4f981ee/","tags":["exploit","vdb-entry","technical-description"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-19T09:25:57.636205Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-19T09:31:21.214Z","content_hash":"a12f8fc6cb134b60efc7ea44ab8c9664d221db12e017104f861bfaecdf0d0435"}}