This vulnerability in Noptin Newsletter Team's Noptin plugin involves improper neutralization of input during web page generation, resulting in a stored cross-site scripting (XSS) flaw. It affects versions up to 3.8.7 and allows attackers with high privileges and user interaction to inject malicious scripts that can impact confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and a scope change with low impact on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of malicious scripts in the context of affected users, potentially compromising user data confidentiality, integrity, and availability. The attack requires high privileges and user interaction, limiting the ease of exploitation. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and apply input validation or sanitization controls where possible to mitigate risk.