This vulnerability arises from improper neutralization of user input when generating web pages, allowing an attacker to store and later deliver malicious JavaScript to visitors. The stored XSS payload is rendered whenever the affected page is viewed, giving the attacker the ability to execute arbitrary client‑side code in the context of the site. Storing such code can compromise the confidentiality, integrity, or availability of the site’s content and may affect all users who load the compromised page.

WordPress installations using the Noptin Newsletter Team Noptin newsletter‑optin‑box plugin up to version 3.8.7 are impacted. Any site that has remained on or installed a version in the range n/a through 3.8.7 could be vulnerable.

The CVSS score of 5.9 indicates a moderate severity impact. The EPSS score of less than 1% points to a low likelihood of exploitation at present. This stored XSS flaw is likely accessible to authenticated administrators or users who can submit content through the plugin’s data entry interface; however, the exact vector is not explicitly documented, so it is inferred that the attacker must first gain plugin-access privileges. The vulnerability is not currently listed in the CISA KEV catalog.