What is the CVSS score of CVE-2026-66703?

CVE-2026-66703 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

MailOptin CVE-2026-66703

EUVD-2026-53907 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-7h59-5f8r-wcwf

WordPress XSS Wordpress Plugin Mailoptin Properfraction

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Contributor auth required (PR:L), admin must view content (UI:R), scope changes to admin session (S:C); no server-side availability impact justifies A:N over the source data's A:L.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:02 vuln.today

DescriptionCVE.org

Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions.

AnalysisAI

Stored Cross-Site Scripting in MailOptin WordPress plugin (versions ≤ 1.2.78.0) allows Contributor-level authenticated users to inject malicious JavaScript payloads that execute in the browser context of higher-privileged users - typically site administrators - when they view the affected content. The CVSS scope change (S:C) confirms the injected script escapes the contributor's own context, making this an effective privilege escalation vector in multi-author WordPress environments. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

MailOptin is a WordPress plugin developed by properfraction, used for email opt-in forms, lead generation, and marketing automation. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as insufficient sanitization or escaping of Contributor-supplied input before it is rendered in an HTML context. The CPE string cpe:2.3:a:properfraction:mailoptin:*:*:*:*:*:*:*:* indicates all mainline releases through 1.2.78.0 are affected without version-range exclusions. In WordPress's role hierarchy, the Contributor role can draft and submit posts but cannot publish - however, this vulnerability demonstrates that content awaiting administrator review can carry executable payloads, exploiting the review workflow itself as a delivery mechanism.

RemediationAI

Update MailOptin to a version above 1.2.78.0. The exact patched release version is not independently confirmed from the available intelligence data - verify the current safe version via the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/mailoptin/vulnerability/wordpress-mailoptin-plugin-1-2-78-0-cross-site-scripting-xss-vulnerability before deploying. As an interim compensating control, audit all accounts holding the Contributor role and revoke access from any untrusted or unnecessary users; this directly eliminates the PR:L attack prerequisite. Disabling contributor-level content submission workflows entirely removes the injection surface at the cost of losing that authoring capability. Implementing a strict Content Security Policy (CSP) header with script-src restricted to known safe origins can limit the execution impact of any residual XSS, though CSP is a defense-in-depth measure and not a substitute for patching.