The MailChimp Subscribe Forms plugin for WordPress, versions 4.3.3 and earlier, contains an unauthenticated cross‑site scripting vulnerability. The flaw allows an attacker to supply malicious input that is rendered without proper sanitization, enabling the execution of arbitrary JavaScript in the context of anyone viewing a page that includes the plugin. This can lead to session hijacking, data theft, defacement, or the execution of further attacks such as phishing. The weakness is classified as CWE‑79.

The vulnerability affects the PluginOps MailChimp Subscribe Forms WordPress plugin. All installations running version 4.3.3 or earlier are impacted.

The CVSS base score of 7.1 indicates a high severity, and the lack of authentication requirement means that an attacker can exploit the flaw from an arbitrary web request directed at the vulnerable site. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. Nevertheless, due to the ability to run arbitrary code in the victim’s browser, the risk remains significant.