Description

Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-06T15:17:23.273Z",
  "pubdate": "2026-08-06T15:17:23.273Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the MailOptin plugin, specifically affecting versions 1.2.78.0 and prior. This security flaw allows malicious actors with specific contributor-level privileges to inject and persist arbitrary client-side scripts, typically JavaScript, within the application context. The primary impact of this vulnerability involves the execution of malicious code in the browser of other users viewing the affected administrative or public pages, potentially leading to session hijacking, credential theft, or unauthorized administrative actions depending on the target user's privilege level. The risk implications are moderate to high, as successful exploitation undermines the integrity of the affected WordPress environment. Attacker capabilities are constrained by the necessity of possessing contributor-level access to the vulnerable system, meaning unauthorized external actors cannot exploit this flaw without prior credential compromise or account provisioning. Exploitation requirements mandate that the attacker authenticates with at least contributor privileges to supply the malicious payload through input vectors inadequately sanitized or escaped by the MailOptin plugin.",
  "technicalDetails": "The vulnerability resides in the input sanitization and output encoding mechanisms of the MailOptin plugin for versions <= 1.2.78.0. Specifically, the root cause stems from the application's failure to properly sanitize user-supplied input submitted by users with contributor privileges before storing it in the database and subsequently rendering it within the Document Object Model (DOM).\nExploitation of this Cross-Site Scripting vulnerability occurs when a malicious contributor injects crafted HTML or JavaScript payloads into input fields processed by the vulnerable component. Because the application lacks adequate context-aware output encoding, the injected payload is treated as executable code by the victim's browser rather than inert string data.\nThe attack flow proceeds as follows: First, the authenticated attacker with contributor privileges crafts a malicious payload containing arbitrary JavaScript. Second, the attacker submits this payload via the vulnerable parameter handled by the MailOptin plugin. Third, the application accepts and stores the unsanitized input within the database without applying strict validation or neutralization routines. Fourth, when an administrator or higher-privileged user navigates to the affected dashboard or rendered page, the server retrieves the malicious payload and reflects or serves it in the HTTP response.\nFinally, the victim's browser parses the response, executing the arbitrary JavaScript within the security context of the victim's active session. This enables post-exploitation activities such as performing unauthorized actions on behalf of the user, stealing session cookies, or leveraging elevated privileges to compromise the underlying application further."
}