CVE-2026-119468: WordPress Noptin plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerability
Published Nov 4, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noptin Newsletter Team Noptin newsletter-optin-box allows Stored XSS.This issue affects Noptin: from n/a through 4.4.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Noptin pluginto a version that resolves this vulnerability.Fixed in 4.4.3
Event History
Nov 4, 2026
CVE Published
via MITRE·12:08 PM
Data Sourced
via MITRE·12:08 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What versions are affected?
Noptin versions through 4.4.2 are affected. The available data does not identify a fixed version.
2
What does an attacker need to exploit this issue?
The vector is network-based, requires low attack complexity, and requires no privileges. Exploitation does require user interaction.
3
What is the likely impact if exploitation succeeds?
The vulnerability can result in limited impact to confidentiality, integrity, and availability. Its scope can extend beyond the vulnerable component.