Description

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields (e.g., 'text_subscribed', 'text_error') in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-22T14:16:33.080Z",
  "pubdate": "2026-08-22T14:16:33.080Z",
  "executiveSummary": "The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form response message post meta fields, specifically parameters such as 'text_subscribed' and 'text_error'.\nThis vulnerability impacts all versions up to, and including, 4.12.0.\nThe security flaw arises due to insufficient input sanitization and output escaping mechanisms implemented within the affected form response message handlers.\nAuthenticated attackers possessing Author-level access and above can exploit this vulnerability to inject arbitrary web scripts into pages.\nThese malicious scripts execute in the context of a victim's browser whenever any user accesses the injected page, potentially leading to session hijacking, credential theft, or unauthorized administrative actions.\nSuccessful exploitation requires authenticated access with specific privilege levels, limiting external unauthenticated attacks but elevating risks from compromised or malicious internal accounts.",
  "technicalDetails": "The root cause of this Stored Cross-Site Scripting vulnerability in MC4WP: Mailchimp for WordPress lies in the inadequate validation, sanitization, and contextual output escaping of user-supplied data destined for post meta fields.\nSpecifically, form response message configuration parameters such as 'text_subscribed' and 'text_error' accept administrative input without properly neutralizing executable markup.\nWhen an authenticated attacker with Author-level access or higher modifies these configuration fields, malicious JavaScript payloads are persistently stored within the WordPress database.\nThe vulnerable component processes and renders these stored post meta values directly into the Document Object Model (DOM) without applying appropriate output encoding functions.\nThe attack flow proceeds as follows: 1) An authenticated attacker with Author privileges navigates to the plugin's form settings interface. 2) The attacker injects malicious JavaScript payloads into the response message fields ('text_subscribed' or 'text_error'). 3) The input is processed and written to the database as post meta without undergoing strict sanitization. 4) A victim, which may include high-privileged administrators or standard users, interacts with a frontend or backend page where the Mailchimp form response is rendered. 5) The browser executes the embedded script in the victim's session.\nBecause the payload executes within the context of the user's browser session, post-exploitation impact includes the potential theft of sensitive session cookies, DOM manipulation, forced actions, or cascading privilege escalation attacks against administrative users."
}