CVE-2026-66703

MediumCVSS 6.5

Published: 06/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

4th percentile - higher than 4% of all known CVEs

Summary

A Cross Site Scripting (XSS) vulnerability in the MailOptin plugin (versions up to 1.2.78.0) occurs at the contributor level. A user with the contributor role can inject a malicious script that executes in the browsers of other users.

Risk Assessment

An attacker with the contributor role can steal session data, take over user accounts, or spread malicious content. The risk affects all users visiting pages with the plugin.

Recommendation

It is recommended to update the MailOptin plugin to the latest version that includes the fix. Also, restrict contributor permissions and regularly audit user-published content.

Other vulnerabilities in MailOptin

CVE-2026-57813Critical
The MailOptin WordPress plugin contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions from n/a through 1.2.77.3 inclusive.

Original NVD description (English source)

Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions.