Noptin Newsletter CVE-2026-103482

Exploitation requires a pre-existing published Noptin campaign post whose body contains a [[subscriber.*]] merge tag (e.g. first_name) - without such a campaign there is no sink to store the payload. The unauthenticated attacker must first POST an entity-encoded payload to the public manage_preferences form (which issues its own nonce on the same page, so the nonce is not a barrier), then obtain/embed their own confirm_key into a campaign preview URL. Execution only occurs when a privileged user is socially engineered into opening that preview URL, so the script runs in the victim's authenticated browser context. Limiting factors: dependence on a non-default vulnerable campaign configuration, required interaction by a privileged victim, and high attack complexity (AC:H) materially constrain realistic exploitation despite the unauthenticated entry point.

This is a medium-severity (CVSS 5.4) stored XSS in the Noptin WordPress newsletter plugin, and the real-world signals point to a low-to-moderate priority rather than an urgent threat. Positive risk signals are limited: AV:N makes it network-reachable and PR:N means the initial injection needs no authentication. However, every other signal dampens the risk - AC:H reflects the multi-stage precondition chain, impacts are only C:L/I:L with A:N, there is no CISA KEV listing, no public exploit code was identified, and no EPSS score was supplied to gauge exploitation probability. CONFLICT TO FLAG: the provided CVSS vector sets UI:N (no user interaction), yet the description's own attack chain explicitly requires socially engineering a privileged user into opening a crafted campaign preview URL - that is user interaction, so the authoritative vector appears to understate the interaction requirement and overstate ease of exploitation; verify UI with Wordfence. Because the payload only fires after a human victim clicks an attacker-supplied link and only when a vulnerable campaign already exists, this behaves as a targeted social-engineering vector, not a wormable or mass-exploitable flaw. A fix (4.4.0) exists, so remediation is straightforward.

An unauthenticated attacker finds a Noptin site that has a published email campaign whose body uses a [[subscriber.*]] merge tag, then submits an entity-encoded script payload through the public manage_preferences form (which supplies its own nonce). The attacker then crafts a campaign preview URL embedding their confirm_key and, through social engineering, convinces a logged-in administrator to open it, at which point the stored script executes in the privileged user's browser session. No public exploit code was identified at time of analysis, and the high attack complexity plus required victim interaction make this an opportunistic, targeted scenario rather than a reliable mass attack.