This vulnerability is a CWE-79 Cross-site Scripting (XSS) issue in the MailOptin plugin for WordPress, identified as CVE-2026-66703. It allows an attacker with contributor-level privileges to inject malicious scripts due to improper input neutralization during web page generation. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges at the contributor level, and user interaction. The impact scope is changed (S:C), with low confidentiality, integrity, and availability impacts (C:L/I:L/A:L). No official patch or remediation level has been provided yet, and no known exploits are reported in the wild.

An attacker with contributor privileges can exploit this vulnerability to execute arbitrary scripts in the context of the affected user's browser. This can lead to partial disclosure of information, modification of data, or disruption of service within the scope of the affected application. The overall impact is rated medium with limited confidentiality, integrity, and availability effects.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level user privileges and monitor for suspicious activity related to MailOptin. Avoid granting unnecessary contributor access to reduce risk.