The advertised plugin for WordPress, encompassing functionality to create email opt-in forms, pop-ups, and subscription widgets, fails to sanitize or escape data supplied in form field values. This oversight permits an unauthenticated user to embed JavaScript that is stored server‑side and subsequently reflected to any visitor viewing the target page. Consequently, an attacker can hijack user sessions, deface the site, or install malware, compromising confidentiality, integrity, and availability of the content consumed by visitors.

Administrators of websites running the MailChimp Subscribe Form, Optin Builder, PopUp Builder, or Form Builder plugin – the product suite developed by umarbajwa – are impacted. All versions up to and including 4.3.3 are vulnerable. No other vendor or product versions have been identified as affected.

The vulnerability carries a CVSS score of 7.2, signalling significant risk when exploitable. The EPSS score is below 1%, indicating that active exploitation events are rare, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated actor submitting malicious payloads through the form interface or via crafted requests, which then persist and execute when any user visits the affected page. Exploitation requires no special privileges beyond input submission and is thereby widely available to threat actors.