Quick answers
- Is CVE-2026-4561 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-4561 being exploited in the wild.
- How severe is CVE-2026-4561?
- Medium severity, with a CVSS score of 6.4, published 22 August 2026.
- Which products and versions are affected?
- MC4WP Mailchimp for WordPress up to 4.12.0.
- Is there a fix for CVE-2026-4561?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-4561 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-4561?
- Check whether you run MC4WP Mailchimp for WordPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the MC4WP plugin affecting versions up to 4.12.0. The root cause is insufficient input sanitization and output escaping of form response message post meta fields such as 'text_subscribed' and 'text_error'. An authenticated attacker with Author-level access or above can inject arbitrary JavaScript code into these fields via the WordPress admin interface. Because the malicious payload is stored in the database and executed whenever the form is rendered, all site visitors viewing the affected page are exposed to the injected script. No special user interaction or out-of-band permissions are required beyond Author-level access to the WordPress admin panel.
Affected products
- MC4WP Mailchimp for WordPress up to 4.12.0
Timeline
- 2026-08-22: disclosed