CVE-2021-38351: 
WordPress vulnerability analysis and mitigation

The OSD Subscribe WordPress plugin (versions up to and including 1.2.3) was identified with a Reflected Cross-Site Scripting vulnerability, tracked as CVE-2021-38351. The vulnerability was discovered and reported by Wordfence on August 9, 2021. The issue exists in the osdsubscribemessage parameter within the ~/options/osdsubscribeoptions_subscribers.php file (NVD, CVE Mitre).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) with a CVSS v3.1 Base Score of 6.1 (Medium). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R). The scope is changed (S:C) with low confidentiality and integrity impact (C:L, I:L) and no availability impact (A:N) (NVD).

If exploited, this vulnerability allows attackers to inject arbitrary web scripts through the osdsubscribemessage parameter. The impact is considered medium severity, with potential for compromising user data and session information through cross-site scripting attacks (NVD).

Users should upgrade their OSD Subscribe WordPress plugin to a version newer than 1.2.3 to mitigate this vulnerability (NVD).