CVE-2026-103482 in Noptin Plugin
Summary
by MITRE • 10/10/2026
The Simple Newsletter Plugin – Noptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noptin_fields[<custom_field_merge_tag>] (e.g. first_name)' parameter in all versions up to, and including, 4.3.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attack chain requires a published campaign post whose body contains a [[subscriber.*]] merge tag; the unauthenticated attacker first POSTs the entity-encoded payload to the public manage_preferences form (which issues its own nonce on the same page), then pivots execution by embedding their confirm_key in a campaign preview URL sent to a privileged user via social engineering.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The Simple Newsletter Plugin, known as Noptin for WordPress, contains a critical stored cross-site scripting vulnerability affecting all versions up to and including 4.3.10. This flaw stems from insufficient input sanitization and output escaping mechanisms within the plugin's handling of custom field merge tags. Specifically, the parameter noptin_fields[<custom_field_merge_tag>], such as first_name, fails to properly validate or encode user-supplied data before it is stored in the database and subsequently rendered on web pages. This lack of rigorous validation allows malicious actors to inject arbitrary JavaScript code into the application's persistent storage, which then executes automatically when other users view content containing these tainted fields.
The operational impact of this vulnerability is significant because it enables unauthenticated attackers to compromise user sessions or steal sensitive information without requiring prior authentication credentials. The attack chain begins with an attacker identifying a published campaign post that contains subscriber merge tags like [[subscriber.first_name]]. By targeting the public manage_preferences form, which issues its own nonce for CSRF protection but fails to sanitize input effectively, the attacker posts entity-encoded malicious payloads. These payloads are stored within the user profile data associated with the specified merge tag context. Because the vulnerability is classified as a Stored Cross-Site Scripting issue under CWE-83, the injected scripts persist on the server side rather than being limited to immediate session-based attacks.
Execution of the malicious code occurs when a privileged or regular user accesses a page that renders the compromised subscriber data. To maximize the effectiveness of this attack, an adversary can pivot by embedding their confirm_key within a campaign preview URL. This technique leverages social engineering tactics where the attacker sends what appears to be a legitimate newsletter preview link to a target victim. When the victim clicks the link and views the content containing the injected merge tag data, the embedded JavaScript executes in the context of the victim's browser session. This can lead to account takeover, credential harvesting, or further propagation within the WordPress environment if additional vulnerabilities are present.
From an industry standard perspective, this vulnerability aligns with MITRE ATT&CK technique T1059.007, which covers JavaScript execution in web browsers as part of client-side code injection. The failure to sanitize input corresponds directly to CWE-20 Improper Input Validation, while the lack of output encoding relates to CWE-83 Cross-site Scripting: Stored XSS. Mitigation strategies must prioritize immediate upgrading to a patched version of the Noptin plugin that addresses these sanitization gaps. In cases where an upgrade is not immediately feasible, administrators should implement strict input validation rules on custom fields and ensure all dynamic content outputting subscriber data utilizes proper HTML entity encoding functions provided by WordPress core libraries such as esc_html or wp_kses_post to neutralize script execution vectors effectively.