Campaign Monitor Forms by Optin Cat
Campaign Monitor Forms by Optin Cat has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2024; all 2 are fixed as of September 2026. Their average CVSS score is 6.6, and the most serious one scores 7.1 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include Missing Authorization.
Every one of the 2 issues recorded for Campaign Monitor Forms by Optin Cat has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. Campaign Monitor Forms by Optin Cat is installed on roughly 200 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2023-5098Campaign Monitor Forms <= 2.5.5 - Missing Authorization to Authenticated(Subscriber+) Options Update via ajax_dismiss_notice
Read the full analysisVulnerability Records

Campaign Monitor Forms by Optin Cat
Author
fatcatapps
Campaign Monitor Optin Cat WordPress Plugin The Campaign Monitor Optin Cat WordPress Plugin lets you create gorgeous Campaign Monitor sign-up forms to your WordPress site in minutes. Gutenberg Compatible This plugin is fully compatible with WordPress 5.0’s new content editor (“Gutenberg”). Simply create your optin form, then add your Campaign Monitor block to your website. Opt-in Types Post boxes let you add a Campaign Monitor form to a post or page using shortcodes or by automatically appending the form to the bottom of your post or page. Sidebar widgets. You can add Campaign Monitor forms to your sidebar using widgets. Popups. Capture more emails using lightbox popups. Features Popup targeting based on time spent on page and frequency. Intuitive user interface, set up your Campaign Monitor forms in seconds. Full customization options, such as the ability to change your copy, font-size, colors and more. Campaign Monitor form works with responsive sites. Form validation. Redirect users to a “Thank You”-page after submission. Build unlimited Campaign Monitor forms. Analytics feature so you can learn which Campaign Monitor forms work well and which ones don’t. WordPress 5.0 Gutenberg support. Add Campaign Monitor blocks to WordPress’ new visual editor with ease. Developer Friendly You can customize your Campaign Monitor forms using our “Custom CSS” feature. You can inherit your theme’s form styling by choosign our “No CSS” layout. Optin Cat Premium Optin Cat Premium helps you get more Campaign Monitor subscribers: Lots of extra layout & design options. Smart popup targeting. Mobile Campaign Monitor popups. Two Step Optins: Trigger a popup after the user clicks on a hyperlink. Optin Bait Delivery: Send optin baits straight from WordPress. Exit Intervention: Display popups when the user is about to leave your site. Attention grabbing Popup Effects. Priority email support. Learn more about Optin Cat Premium >> Roadmap We’ve got a bunch of feature ideas, such as more opt-in form designs and various types of signup forms. We’d love to hear your suggestions, feel free to share them in the support forum. Requirements In order to use this plugin you’ll need a Campaign Monitor account + Campaign Monitor API key. Relevant Links FatcatApps.com Other plugins by FatcatApps Privacy Disclosure This plugin stores personal data (eg. names & emails collected using this plugin) in the WordPress database. This plugin integrates with the WordPress GDPR privacy controls for data export & data deletion added in WordPress 4.9.6. This plugin uses a browser cookie to track successful optins. This plugin can be configured to connect to 3rd party service providers such as Campaign Monitor. If you use this plugin to connect to a 3rd party, personal data may also be shared with that party. Additional privacy policy information for 3rd party services can be found here: Campaign Monitor Our full privacy policy is available here: https://fatcatapps.com/legal/privacy-policy/
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C