Newsletter subscription optin module
Newsletter subscription optin module has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for Newsletter subscription optin module has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Nguyen Xuan Chien. Newsletter subscription optin module is installed on roughly 50 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 5.8.15.
CVE-2025-48308Newsletter subscription optin module <= 1.2.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Newsletter subscription optin module
Author
nonletter
This plugin enables you to create simple forms for subscription to your newsletter. It includes a sidebar widget with customizable fields (up to 16) to gather from your users all the information you need for your email marketing campaigns. Users can also use the form to unsubscribe. From the options pages you can: choose whether you require a double opt-in (users must follow a link in an email message, in order to complete subscription) specify name and number of text fields in the form customize text messages and labels manage subscribed email addresses donwload PDF file with list of subscribers download CSV file with list of subscribers choose whether you want to download all subscribers or only new subscribers Related features (Un)subscription requests can be directly processed by SendBlaster bulk email software : download SendBlaster here Plugin Features Subscribe new members Unsubscribe existing members Stores subscribed email addresses (as a useful backup against mail delivery failures) Purges old email addresses Customizable sidebar appearance Customizable texts and labels Adds to your form up to 5 custom fields Plugin Options E-mail address for managing subscriptions Message to subscriber – subject Message to subscriber – content Double Opt-in Link Love (enable and disable) Front side messages Front side appearance and custom fields Temporary db of newly subscribed members Automatic temporary db cleanup
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C