CVE-2026-103482 Simple Newsletter Plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot

The Simple Newsletter Plugin – Noptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noptinfields e.g. firstname' parameter in all versions up to, and including, 4.3.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

CVE-2026-103482

The Simple Newsletter Plugin (Noptin) for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) in versions up to and including 4.3.10 . The root cause is insufficient input sanitization and output escaping within the noptin_fields[] parameter. An unauthenticated attacker c...