Skip to content
OpenAdvisories

Vendor

picocodes

2 known vulnerabilities.

Products

Noptin – Newsletter, New Post Notifications & Email Automation 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-119616

    Noptin <= 4.4.3 - Unauthenticated Local File Inclusion via 'the_template_path' Merge-Tag Attribute via Stored Subscriber first_name

    The Noptin – Newsletter, New Post Notifications & Email Automation plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.4.3 via the 'noptin_fields[first_name]' parameter parameter. This makes it possible for unaut…

    picocodes Noptin – Newsletter, New Post Notifications & Email Automation Web / CMS
  • Medium 5.4
    CVE-2026-103482

    Simple Newsletter Plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot

    The Simple Newsletter Plugin – Noptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noptin_fields[<custom_field_merge_tag>] (e.g. first_name)' parameter in all versions up to, and including, 4.3.10 due to insufficient input saniti…

    picocodes Noptin – Newsletter, New Post Notifications & Email Automation Web / CMS