rootpwn

medium · CVSS v3 6.1 · EPSS 0.00215

CVE-2026-87917

The MC4WP: Mailchimp for WordPress plugin contains a Reflected Cross-Site Scripting vulnerability via the 'data' Dynamic Content Tag in vers

Overview

The MC4WP: Mailchimp for WordPress plugin contains a Reflected Cross-Site Scripting vulnerability via the 'data' Dynamic Content Tag in versions up to and including 4.14.0. This flaw arises from insufficient input sanitization and output escaping. It matters because unauthenticated attackers can trick users into clicking specially crafted links to execute arbitrary web scripts in their browser context.

Description

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Impact

This vulnerability impacts the integrity and confidentiality of user sessions on vulnerable WordPress sites by allowing arbitrary script execution within a victim's browser session. Unauthenticated attackers can potentially hijack user sessions, steal sensitive data, or perform unauthorized actions on behalf of the victim. System administrators and users interacting with the WordPress dashboard or frontend forms are primarily at risk.

Remediation

Update the MC4WP: Mailchimp for WordPress plugin to version 4.14.1 or later where output escaping and input sanitization have been properly implemented. Implement Web Application Firewall (WAF) rules to detect and block suspicious query parameters associated with reflected cross-site scripting attempts. Monitor plugin change logs and maintain a strict patching cadence for all third-party WordPress components.

Risk context

The vulnerability is rated as medium severity with a CVSS v3 score of 6.1, indicating a moderate technical risk. The current EPSS score is 0.00215, suggesting a relatively low probability of active exploitation in the wild at this time, though defenders should still prioritize timely remediation.

Affected products

  • MC4WP Mailchimp for WordPress plugin

Scores

Severity
medium
CVSS v2
6.4
CVSS v3
6.1
CVSS v4
—
EPSS
0.00215

WordPress Plugin XSS Reflected XSS Web Security Input Sanitization

← All CVEs

Related CVEs

medium

CVE-2026-12042

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) within its administrative settings. This vulnerability exists in all versions up to 2.4.12 due to inadequate input sanitization and output escaping of user-provided data.

View analysis

medium

CVE-2026-15660

The SEO Booster plugin for WordPress versions up to 7.4.7 suffers from a missing authorization check that allows any authenticated user with Subscriber role or higher to overwrite critical options. This can disrupt the Google Search Console integration and inject attacker‑supplied data into site options. The flaw is exploitable via a crafted /wp-admin/ URL that triggers the vulnerable handle_oauth_callback function.

View analysis

medium

CVE-2026-15760

The Divi Essential plugin for WordPress contains a vulnerability in its AJAX handlers that allows authenticated users to access sensitive database information. Due to missing authorization checks and bypassable security tokens, any user with Subscriber-level access can enumerate and read arbitrary database tables. This exposure includes critical data such as user credentials, session tokens, and site configuration settings.

View analysis

medium

CVE-2025-15698

The Business Name Generator plugin for WordPress, up to version 1.3, contains a vulnerability where configuration settings are not properly sanitized or escaped. This allows high-privileged users to inject malicious scripts into the application's database, which are then executed when the settings page is viewed.

View analysis