WPIntell

Source evidence

Google flagging a VULNERABILITY

WP Subtitle · support · 2025-09-29T16:02:00+00:00

WP Subtitle plugin evidence original source source API
complaintsentiment
highseverity
1.0relevance
5replies
Evidence linked to opportunitycommercial context

Proof Health

Open evidence

Commercial opportunities need traceable source links before they are treated as build-worthy.

5 / 34 rows with source links

14.7% of this page's analysis has direct source links.

0 build-decision rows missing links

0 rows here require auditable proof before promotion.

29 rows with no attached evidence

0 rows have source counts but still need direct links.

Conversation

support
Jennifer Moss unresolved
Google is flagging this plugin has a vulnerability. Do you have plans to patch it? I, too, would like to know. Wordfence is flagging is as critical . For info: WP Subtitle <= 3.4.1 – Authenticated (Contributor+) Stored Cross-Site Scripting Vulnerability Severity: 6.4/10.0 (Medium) https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-subtitle/wp-subtitle-341-authenticated-contributor-stored-cross-site-scripting Following this thread as well, would like to know if a fix is coming. WP Subtitle <= 3.4.1 – Authenticated (Contributor+) Stored Cross-Site Scripting I think the line in question is in includes/subtitle.php , line 126: return update_metadata( 'post', $this->post_id, $this->get_post_meta_key(), $subtitle ); That puts the raw subtitle into the DB which could contain Javascript code… and if not escaped when output … you get Stored Cross-Site Scripting… Adding a sanitize_text_field should address the issue as it strips all tags: return update_metadata( 'post', $this->post_id, $this->get_post_meta_key(), sanitize_text_field( $subtitle ) ); Is that the first time it saves? Make sure you get all instances of it inserting and updating. Thanks! I think this has now been fixed in version 3.4.2

Comments

5 shown
funex 2025-09-30T05:44:00+00:00

I, too, would like to know. Wordfence is flagging is as critical . For info: WP Subtitle <= 3.4.1 – Authenticated (Contributor+) Stored Cross-Site Scripting Vulnerability Severity: 6.4/10.0 (Medium) https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-subtitle/wp-subtitle-341-authenticated-contributor-stored-cross-site-scripting

Keryn 2025-10-17T00:56:00+00:00

Following this thread as well, would like to know if a fix is coming.

Nick Ciske 2026-02-05T03:52:00+00:00

WP Subtitle <= 3.4.1 – Authenticated (Contributor+) Stored Cross-Site Scripting I think the line in question is in includes/subtitle.php , line 126: return update_metadata( 'post', $this->post_id, $this->get_post_meta_key(), $subtitle ); That puts the raw subtitle into the DB which could contain Javascript code… and if not escaped when output … you get Stored Cross-Site Scripting… Adding a sanitize_text_field should address the issue as it strips all tags: return update_metadata( 'post', $this->post_id, $this->get_post_meta_key(), sanitize_text_field( $subtitle ) );

Jennifer Moss 2026-03-04T15:59:00+00:00

Is that the first time it saves? Make sure you get all instances of it inserting and updating. Thanks!

Ben Huson 2026-03-05T22:14:00+00:00

I think this has now been fixed in version 3.4.2