Noptin Newsletter New Post Notifications Email Automation
Monthly
Stored cross-site scripting (XSS) in the Noptin Newsletter WordPress plugin up to version 4.3.10 allows unauthenticated attackers to inject malicious scripts that execute in the browser of a privileged user. Exploitation requires a published campaign post containing a [[subscriber.*]] merge tag and social engineering of an admin to visit a crafted preview URL; the independent assessment rates this as medium severity (CVSS 5.4) with high attack complexity and required user interaction. No public exploit identified at time of analysis.
Stored cross-site scripting (XSS) in the Noptin Newsletter WordPress plugin up to version 4.3.10 allows unauthenticated attackers to inject malicious scripts that execute in the browser of a privileged user. Exploitation requires a published campaign post containing a [[subscriber.*]] merge tag and social engineering of an admin to visit a crafted preview URL; the independent assessment rates this as medium severity (CVSS 5.4) with high attack complexity and required user interaction. No public exploit identified at time of analysis.