wx_subscribe vulnerabilities

CVEs whose affected-version data names the wx_subscribe package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-91833Medium· 6.8

yesterday

WX Subscribe <= 1.2.1 - Unauthenticated SQLi via 'attach' Parameter

The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks on installs where the payment key …

▾ SunlitEPSS 0.18%via CVEORG