MailOptin vulnerabilities

The MailOptin plugin for WordPress (versions up to and including 1.2.78.6) is vulnerable to privilege escalation. The subscribe_to_email_list endpoint accepts the optin_data[form_custom_field_mappings] parameter without validation, allowing an attacker to override the administrator's mapping and pass arbitrary wp_users columns (including ID and user_pass) to wp_insert_user().

The MailOptin WordPress plugin contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions from n/a through 1.2.77.3 inclusive.

A Cross Site Scripting (XSS) vulnerability in the MailOptin plugin (versions up to 1.2.78.0) occurs at the contributor level. A user with the contributor role can inject a malicious script that executes in the browsers of other users.