Threats tagged 'ghsa-fgpr-5vg8-8pv9'

The Noptin plugin for WordPress, used for newsletters and email automation, is vulnerable to stored cross-site scripting (XSS) in all versions up to and including 4.3.10. This vulnerability arises from insufficient input sanitization and output escaping of the 'noptin_fields[<custom_field_merge_tag>]' parameter. An unauthenticated attacker can inject malicious scripts that execute when a user accesses a page containing the injected content. Exploitation requires a published campaign post with a subscriber merge tag and involves social engineering to trick privileged users into visiting a crafted campaign preview URL.