CVE-2026-66703
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A Cross Site Scripting (XSS) vulnerability in the MailOptin plugin (versions up to 1.2.78.0) occurs at the contributor level. A user with the contributor role can inject a malicious script that executes in the browsers of other users.
Risk Assessment
An attacker with the contributor role can steal session data, take over user accounts, or spread malicious content. The risk affects all users visiting pages with the plugin.
Recommendation
It is recommended to update the MailOptin plugin to the latest version that includes the fix. Also, restrict contributor permissions and regularly audit user-published content.
Other vulnerabilities in MailOptin
See all- CVE-2026-109515Critical
The MailOptin plugin for WordPress (versions up to and including 1.2.78.6) is vulnerable to privilege escalation. The subscribe_to_email_list endpoint accepts the optin_data[form_custom_field_mappings] parameter without validation, allowing an attacker to override the administrator's mapping and pass arbitrary wp_users columns (including ID and user_pass) to wp_insert_user().
- CVE-2026-57813Critical
The MailOptin WordPress plugin contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions from n/a through 1.2.77.3 inclusive.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS