CVE-2014-2274 — Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via a request to the subscribe-to-comments-reloaded/options/index.php page to wp-admin/admin.php

Back Back to CVE browser

HIGH

Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via a request to the subscribe-to-comments-reloaded/options/index.php page to wp-admin/admin.php

Published Mar 19, 2018

8.8

HIGH

CVSS 3.0

EPSS 0.91%

Description

Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via a request to the subscribe-to-comments-reloaded/options/index.php page to wp-admin/admin.php.

Affected products

Remediation

No remediation recorded yet.

Metrics

0.91% 0.00911

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00911

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (16 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.91% (0.00911)	58.56th	v5 (v2026.06.15)
Jun 15, 2026	0.94% (0.00944)	56.26th	v5 (v2026.06.15)
Mar 30, 2025	0.17% (0.00174)	35.56th	v4 (v2025.03.14)
Mar 29, 2025	1.67% (0.01674)	70.69th	v4 (v2025.03.14)
Mar 17, 2025	0.12% (0.00124)	29.12th	v4 (v2025.03.14)
Dec 12, 2024	0.44% (0.00444)	75.75th	v3 (v2023.03.01)
Feb 27, 2024	0.44% (0.00444)	74.27th	v3 (v2023.03.01)
Feb 8, 2024	0.63% (0.00630)	78.37th	v3 (v2023.03.01)
Aug 10, 2023	0.63% (0.00630)	76.33th	v3 (v2023.03.01)
Apr 17, 2023	0.57% (0.00573)	74.66th	v3 (v2023.03.01)
Mar 13, 2023	0.40% (0.00404)	69.61th	v3 (v2023.03.01)
Mar 7, 2023	0.51% (0.00509)	72.94th	v3 (v2023.03.01)
Mar 6, 2023	1.05% (0.01055)	52.13th	v2 (v2022.01.01)
Sep 17, 2022	1.05% (0.01055)	50.47th	v2 (v2022.01.01)
Apr 1, 2022	1.05% (0.01055)	48.43th	v2 (v2022.01.01)
Feb 4, 2022	1.05% (0.01055)	27.52th	v2 (v2022.01.01)

Weaknesses (1)

CWE-352

CSRF

References (2)

https://security.dxw.com/advisories/stored-xss-and-csrf-vulnerabilities-in-subscribe-to-comments-reloaded-140129/
x_refsource_MISCExploitThird Party Advisory
https://wordpress.org/plugins/subscribe-to-comments-reloaded/#developers
x_refsource_CONFIRMThird Party Advisory

Link	Providers	Tags
https://security.dxw.com/advisories/stored-xss-and-csrf-vulnerabilities-in-subscribe-to-comments-reloaded-140129/		x_refsource_MISCExploitThird Party Advisory
https://wordpress.org/plugins/subscribe-to-comments-reloaded/#developers		x_refsource_CONFIRMThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Mar 19, 2018

Updated Aug 6, 2024

Reserved Mar 4, 2014

Link CVE-2014-2274

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2014-2274

Red Hat

Severity n/a

Public date n/a

Links CVE-2014-2274