Junglewise Threat Intelligence

CVE-2026-15000: rnzo Connect Contact Form 7 and Mailchimp Stored XSS

CVE-2026-15000 · Severity: high · CVSS 7.2 · Published 2026-07-09

Executive brief

The Connect Contact Form 7 and Mailchimp plugin for WordPress, which integrates website contact forms with Mailchimp marketing lists, is vulnerable to a security flaw. An attacker can submit malicious code through a contact form that remains hidden until a site administrator views that specific entry. If triggered, this could allow the attacker to perform unauthorized actions in the administrator's browser, potentially compromising the website's security.

Technical details

The Connect Contact Form 7 and Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on Mailchimp Merge Field Values. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts into the database via form submissions. The malicious payload is stored and subsequently executed in the context of a privileged user's browser when an Administrator performs a 'Contact Lookup' for the affected email address. The issue exists in all versions up to and including 0.9.78.06. A patch or update should be applied to remediate the lack of proper escaping in the contact lookup component.

Affected products

  • rnzo Connect Contact Form 7 and Mailchimp <= 0.9.78.06

Timeline

  • 2026-07-09: disclosed: Vulnerability published to NVD

References