CVE-2026-103482

Name of the Vulnerable Software and Affected Versions Simple Newsletter Plugin – Noptin versions prior to 4.3.11

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the noptin fields[<custom field merge tag>] parameter (e.g., first name) in the public manage preferences form. Exploitation requires a published campaign post containing a [[subscriber.*]] merge tag. An attacker can submit an entity-encoded payload to the form and then trigger the execution by sending a campaign preview URL containing their confirm key to a privileged user through social engineering.

Recommendations Update to a version newer than 4.3.10.