# CVE-2026-87917: MC4WP: Mailchimp for WordPress reflected cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-87917-the-mc4wp-mailchimp-for-wordpress-plugin-for-wordpress-is  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-19. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-87917 · Severity: medium · CVSS 6.1 · Published 2026-09-19

The MC4WP: Mailchimp for WordPress plugin, used by websites to manage email subscription forms, is vulnerable to reflected cross-site scripting attacks. An attacker can craft a malicious link that, when clicked by a user, injects malicious code into the webpage and executes it in the victim's browser, potentially stealing credentials or session information without requiring authentication.

Technologies: [MC4WP Mailchimp for WordPress](https://junglewise.ai/threats/technologies/mailchimp-for-wordpress). Vendors: [MC4WP](https://junglewise.ai/threats/vendors/mc4wp).

## Quick answers

**Is CVE-2026-87917 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87917 being exploited in the wild.

**How severe is CVE-2026-87917?** Medium severity, with a CVSS score of 6.1, published 19 September 2026.

**Which products and versions are affected?** MC4WP Mailchimp for WordPress up to and including 4.14.0.

**Is there a fix for CVE-2026-87917?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-87917 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-87917?** Check whether you run MC4WP Mailchimp for WordPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the 'data' dynamic content tag handler due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary JavaScript through URL parameters that gets reflected in the page response without proper escaping. This reflected XSS requires user interaction (clicking a crafted link) but can compromise session tokens or sensitive data.

## Affected products

- MC4WP Mailchimp for WordPress up to and including 4.14.0

## Timeline

- 2026-09-19: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/mailchimp-for-wp/tags/4.14.0/includes/class-dynamic-content-tags.php](https://plugins.trac.wordpress.org/browser/mailchimp-for-wp/tags/4.14.0/includes/class-dynamic-content-tags.php)
- [https://plugins.trac.wordpress.org/browser/mailchimp-for-wp/tags/4.14.0/includes/forms/class-form-tags.php](https://plugins.trac.wordpress.org/browser/mailchimp-for-wp/tags/4.14.0/includes/forms/class-form-tags.php)

## Related threats

- [MC4WP: Mailchimp for WordPress audience validation bypass](https://junglewise.ai/threats/cve-2026-118167-the-mc4wp-mailchimp-for-wordpress-plugin-before-4-15-0-does-not)
- [MC4WP: Mailchimp for WordPress stored cross-site scripting in form response messages](https://junglewise.ai/threats/cve-2026-4561-mc4wp-mailchimp-for-wordpress-stored-cross-site-scripting-in-form)