Executive brief
MailOptin is a popular WordPress plugin used to build email marketing automation and capture lists. A Cross Site Scripting (XSS) vulnerability in versions up to 1.2.78.0 allows a contributor-level user to inject malicious scripts that can steal visitor data or hijack their accounts. Exploitation requires user interaction from a privileged contributor.
Technical details
The vulnerability is a Contributor-level Cross Site Scripting (XSS) vulnerability in MailOptin WordPress plugin versions 1.2.78.0 and earlier. The attack vector requires a contributor or higher privilege user to perform an action (clicking a link, visiting a crafted page, or submitting a form) to inject malicious scripts. Successful exploitation allows attackers to inject arbitrary JavaScript into the site that can steal visitor data, hijack user accounts, or perform other client-side attacks. The vulnerability was patched in version 1.2.78.1 released on July 29, 2026.
Affected products
- MailOptin MailOptin <= 1.2.78.0
Timeline
- 2026-07-29: disclosed: Reported by Ananda Dhakal (Patchstack)
- 2026-07-29: patched: Fixed in version 1.2.78.1
- 2026-08-06: advisory: CVE-2026-66703 published