picocodes Noptin – Newsletter, New Post Notifications & Email Automation

• CVE-2026-119616 Medium 5.9 Noptin <= 4.4.3 - Unauthenticated Local File Inclusion via 'the_template_path' Merge-Tag Attribute via Stored Subscriber first_name –
• CVE-2026-103482 Medium 5.4 Simple Newsletter Plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot 0.3%