Stored Cross-Site Scripting Vulnerability in Simple Newsletter Plugin by WordPress

CVE-2026-103482

What is CVE-2026-103482?

The Simple Newsletter Plugin – Noptin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability. This arises from inadequate input sanitization and output escaping on the 'noptin_fields[<custom_field_merge_tag>]' parameter (e.g., first_name) in all versions up to and including 4.3.10. Attackers can exploit this flaw to inject malicious web scripts, which are executed whenever a user interacts with the compromised page. The exploitation requires a campaign post containing a [[subscriber.*]] merge tag. An unauthenticated attacker must first submit an entity-encoded payload to the public manage_preferences form, which generates a nonce. The attacker then disturbs page execution by sending their confirm_key through a socially engineered campaign preview URL to a privileged user.

References