Stored Cross-Site Scripting Vulnerability in MailOptin Plugin

CVE-2024-8628

Summary

The MailOptin plugin for WordPress is prone to a stored cross-site scripting vulnerability that affects all versions up to and including 1.2.70.3. This flaw arises from inadequate input sanitization and output escaping for the 'post-meta' shortcode. Authenticated attackers, possessing contributor-level or higher access, can exploit this vulnerability to inject arbitrary web scripts. These scripts are executed whenever a user accesses the affected page, potentially compromising sensitive user information and undermining the integrity of the website. As a result, maintaining updated versions and implementing stringent security measures is crucial for affected users.

References