CVE-2022-41403: Newsletter Subscribe (popup + Regular Module) Project Newsletter Subscribe (popup + Regular Module)

Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days.

OpenCart 3.x Newsletter Custom Popup was discovered to contain a SQL injection vulnerability via the email parameter at index.php?route=extension/module/so_newletter_custom_popup/newsletter.

Affected products

• Newsletter Subscribe (popup + Regular Module) Project Newsletter Subscribe (popup + Regular Module): version 4.0 only

Published 2022-10-12. Last modified 2026-06-17.