Hello,

Plugin: Subscribe to Comments Reloaded 150611 https://wordpress.org/plugins/subscribe-to-comments-reloaded/

1. Reflected Cross-Site Scripting (XSS) 

Authenticated administrators can inject html/js code (there is no CSRF protection).

Method: GET

Url: http://localhost/wp-admin/options-general.php?page=subscribe-to-comments-reloaded%2Foptions%2Findex.php&subscribepanel=1&sra=edit-subscription&srp=[xss]

Vulnerable parameters: srp, sre

Example PHP callstack:

/subscribe-to-comments-reloaded/options/panel1-edit-subscription.php:14

Verification: