Executive brief
MC4WP: Mailchimp for WordPress is a WordPress plugin that manages email subscription forms integrated with Mailchimp. The plugin is vulnerable to stored cross-site scripting (XSS) in form response message fields, allowing authenticated users with author-level permissions to inject malicious scripts that execute whenever site visitors view affected pages. This could be exploited to deface content, steal visitor data, or redirect users to malicious sites.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the MC4WP plugin affecting versions up to 4.12.0. The root cause is insufficient input sanitization and output escaping of form response message post meta fields such as 'text_subscribed' and 'text_error'. An authenticated attacker with Author-level access or above can inject arbitrary JavaScript code into these fields via the WordPress admin interface. Because the malicious payload is stored in the database and executed whenever the form is rendered, all site visitors viewing the affected page are exposed to the injected script. No special user interaction or out-of-band permissions are required beyond Author-level access to the WordPress admin panel.
Affected products
- MC4WP Mailchimp for WordPress up to 4.12.0
Timeline
- 2026-08-22: disclosed