CVE-2026-103482: Simple Newsletter Plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot
The Simple Newsletter Plugin – Noptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noptinfields[<customfieldmergetag>] (e.g. firstname)' parameter in all versions up to, and including, 4.3.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attack chain requires a published campaign post whose body contains a [[subscriber.]] merge tag; the unauthenticated attacker first POSTs the entity-encoded payload to the public managepreferences form (which issues its own nonce on the same page), then pivots execution by embedding their confirmkey in a campaign preview URL sent to a privileged user via social engineering.
Affected Software
Event History
Frequently Asked Questions
Which sites meet the documented preconditions for exploitation?
The site must have a published campaign post whose body includes a [[subscriber.*]] merge tag. The attacker also needs access to the public manage_preferences form and must induce a privileged user to open a crafted campaign preview URL.
Does an attacker need a WordPress account to start the attack?
No. The vulnerable custom-field input can be submitted through the public manage_preferences form by an unauthenticated attacker.
Who is the intended execution target in the described attack chain?
The payload is triggered when a privileged user accesses the attacker-crafted campaign preview URL containing the attacker’s confirm_key. Social engineering is required to get that user to open the preview.