VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 5 known issues Latest disclosed Sep 03, 2025

MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. Vulnerabilities

Review known vulnerability records for the WordPress plugin MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. (`mailoptin`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2025-58596, CVE-2024-8628 and CVE-2023-23980, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
5
High or Critical
1
Patch Coverage
100%
Last Updated
Sep 10, 2025
Priority CVE Quick Links

Fast paths into MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
4
CVE-2023-23980 Medium 1.2.54.1
CVE-2023-23980 MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. Cross-Site Scripting

MailOptin <= 1.2.54.0 - Authenticated (Admin+) Cross Site Scripting

CVE-2024-8628 Medium 1.2.70.4
CVE-2024-8628 MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. Stored Cross-Site Scripting

Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin <= 1.2.70.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

CVE-2022-36340 Medium 1.2.50.0
CVE-2022-36340 MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. Authorization Bypass

MailOptin <= 1.2.49.0 - Missing Authorization to Cache Deletion

CVE-2025-58596 Medium 1.2.75.1
CVE-2025-58596 MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. Stored Cross-Site Scripting

MailOptin <= 1.2.75.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
5 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
0 critical and 1 high severity finding.
Recent CVEs
CVE-2025-58596, CVE-2024-8628 and CVE-2023-23980
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2025-58596
CVE-2025-58596: MailOptin <= 1.2.75.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

The MailOptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2.75.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to...

Published
Sep 03, 2025
Patched Release
1.2.75.1
Affected Versions
Versions up to 1.2.75.0
Next Step
Update to 1.2.75.1 or newer if supported.
Open CVE-2025-58596 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-8628
CVE-2024-8628: Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin <= 1.2.70.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'post-meta' shortcode in all versions up to, and including, 1.2.70.3 due to insufficient input sanitization and...

Published
Sep 23, 2024
Patched Release
1.2.70.4
Affected Versions
Versions up to 1.2.70.3
Next Step
Update to 1.2.70.4 or newer if supported.
Open CVE-2024-8628 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-23980
CVE-2023-23980: MailOptin <= 1.2.54.0 - Authenticated (Admin+) Cross Site Scripting

The MailOptin plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 1.2.54.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with admin-level permissions and above, to inject ar...

Published
Jan 20, 2023
Patched Release
1.2.54.1
Affected Versions
1.2.54.0 through 1.2.54.0
Next Step
Update to 1.2.54.1 or newer if supported.
Open CVE-2023-23980 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2022-36340
CVE-2022-36340: MailOptin <= 1.2.49.0 - Missing Authorization to Cache Deletion

The MailOptin plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the clear_optin_cache function in versions up to, and including, 1.2.49.0. This makes it possible for unauthenticated attackers to clear the plugin's cache. Additionally,...

Published
Sep 23, 2022
Patched Release
1.2.50.0
Affected Versions
Versions up to 1.2.49.0
Next Step
Update to 1.2.50.0 or newer if supported.
Open CVE-2022-36340 Report Open CVE Reference
Plugin High Patched: Yes
Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin <= 1.2.35.1 - Authorization Bypass

The Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the fetch_custom_fields and fetch_tags functions in versions up to, and including, 1.2.35.1. This m...

Published
Jun 30, 2021
Patched Release
1.2.35.2
Affected Versions
Versions up to 1.2.35.1
Next Step
Update to 1.2.35.2 or newer if supported.
Open Full Report