CVE-2026-119468
Deferred Deferred - Pending Action

Stored XSS in Noptin Newsletter Plugin

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: Patchstack

Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noptin Newsletter Team Noptin newsletter-optin-box allows Stored XSS.This issue affects Noptin: from n/a through 4.4.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-119468
EUVD
EUVD-2026-116889

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Noptin Newsletter Team Noptin 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the Noptin Newsletter plugin for WordPress. It allows attackers to inject malicious scripts into web pages that are stored on the server. These scripts execute when other users view the affected pages.

Detection Guidance

Detecting this vulnerability requires checking the installed version of the Noptin Newsletter plugin. Use the WordPress admin dashboard to verify the plugin version or run SQL queries on the database to inspect the plugin version in the wp_options table.

Impact Analysis

Attackers can steal visitor data, hijack user accounts, or perform actions on behalf of users. Successful exploitation requires a privileged user to interact with a malicious link or form submission. The impact includes potential data breaches and unauthorized access.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or manipulation, which may violate GDPR's data protection requirements if user data is compromised. For HIPAA, it risks exposing protected health information if exploited in healthcare-related WordPress sites.

Mitigation Strategies

Immediately update the Noptin Newsletter plugin to version 4.4.3 or later. If updating is not possible, apply a mitigation rule from Patchstack to block attacks until the update is completed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119468. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...