Description

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-19T08:16:54.917Z",
  "pubdate": "2026-09-19T08:16:54.917Z",
  "executiveSummary": "The MC4WP: Mailchimp for WordPress plugin is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability originating from the 'data' Dynamic Content Tag. This flaw exists in all versions up to, and including, 4.14.0. The vulnerability allows unauthenticated attackers to execute arbitrary JavaScript within the context of a victim's browser session. By successfully inducing a user to interact with a crafted malicious URL, an attacker can hijack user sessions, perform unauthorized actions on behalf of the user, or deface the WordPress environment. This vulnerability poses a significant risk to the integrity and confidentiality of user data, as the lack of robust input sanitization and output encoding mechanisms fails to neutralize malicious payloads embedded in the dynamic content parameters.",
  "technicalDetails": "The root cause of this vulnerability is improper neutralization of user-supplied input within the 'data' Dynamic Content Tag component of the MC4WP plugin. Specifically, the plugin fails to perform rigorous input validation and context-aware output escaping before rendering the data within the HTML document stream. This omission permits the injection of malicious script tags or event handlers directly into the reflected response.\nExploitation is achieved through a Reflected XSS attack vector. An attacker constructs a URI containing a specifically crafted 'data' parameter that includes malicious JavaScript payloads. When this crafted URL is navigated to by an authenticated user—such as an administrator or a privileged subscriber—the server reflects the untrusted input directly into the rendered web page. The browser, failing to identify the content as malicious, interprets the payload as legitimate script executable within the origin of the WordPress site.\nThe attack flow proceeds as follows: First, the attacker identifies a page or endpoint where the 'data' Dynamic Content Tag is processed and rendered. Second, the attacker encodes a JavaScript payload, such as a session cookie exfiltration script or an unauthorized administrative action command, into the 'data' parameter. Third, the attacker employs social engineering to entice a target user into clicking the malicious link. Finally, upon the user visiting the URL, the victim’s browser executes the injected script, granting the attacker the scope and permissions associated with the victim's session.\nThe vulnerability affects all versions of the MC4WP: Mailchimp for WordPress plugin up to, and including, 4.14.0. It requires no prior authentication, as the injection point is accessible to any unauthenticated visitor who can trigger the server-side processing of the malformed 'data' tag. The impact of successful exploitation includes, but is not limited to, arbitrary script execution, session hijacking via document.cookie access, phishing, and forced administrative actions, which significantly compromise the security posture of the WordPress installation."
}