CVE-2022-46803 MEDIUM

CVE-2022-46803: WordPress Noptin Plugin <= 1.9.5 is vulnerable to CSV Injection

Vendor Noptin Newsletter
Product Simple Newsletter Plugin – Noptin
Weakness CWE-1236
Published November 7, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

6.1/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

What the vulnerability does

01Description

Improper Neutralization of Formula Elements in a CSV File vulnerability in Noptin Newsletter Simple Newsletter Plugin – Noptin.This issue affects Simple Newsletter Plugin – Noptin: from n/a through 1.9.5.

Explanation of Vulnerability in Simple Terms

02Summary

Noptin Newsletter Plugin versions up to 1.9.5 contain an integrity vulnerability that allows an attacker to modify site content or data through a network-based attack. The vulnerability requires user interaction—typically the victim must click a malicious link or visit an attacker-controlled page. The impact extends beyond the plugin itself to affect the broader site.

What an attacker can do

03Attacker Capabilities

Modify site content or data by tricking a user into clicking a malicious link.

Potential impact on your site

04Site Impact

Site content or user data could be altered without authorization if a user is socially engineered.

Conditions required to exploit

05Prerequisites

Victim must click an attacker-supplied link or visit an attacker-controlled page; no authentication required.

Key dates

06Disclosure timeline

November 7, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2023-0721 Metform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection CVE-2022-45078 WordPress User Blocker Plugin <= 1.5.5 is vulnerable to CSV Injection CVE-2022-45810 WordPress Email Subscribers & Newsletters Plugin <= 5.5.2 is vulnerable to CSV Injection CVE-2023-36527 WordPress Post to CSV by BestWebSoft Plugin <= 1.4.0 is vulnerable to CSV Injection CVE-2025-11254 Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injection