Technical impact
The Mailchimp for WordPress plugin is vulnerable to stored cross‑site scripting because form response message meta fields, such as 'text_subscribed' and 'text_error', are not properly sanitized or escaped. Authenticated users with Author or higher privileges can inject arbitrary scripts that execute whenever a user opens an affected form page. This flaw allows an attacker to compromise the integrity of page content and potentially hijack user sessions or steal data. The CVE exploits the classic input validation weakness identified as CWE‑79.
Affected Systems
The vulnerability affects the dvankooten:MC4WP: Mailchimp for WordPress product in all releases up to and including version 4.12.0. Users deployed with these versions are at risk if they allow author‑level or higher access to form management functions.
Risk and Exploitability
The CVSS metric of 6.4 indicates moderate severity. Exploitation requires authenticated access with at least author permissions, which is common for content editors. Although the EPSS score is unavailable, the lack of a KEV listing suggests no public exploit is known yet, but the vulnerability remains actionable. The attack vector is likely through manipulation of form settings, inserting malicious script into response fields, and then having other authenticated or anonymous users view those pages, resulting in cross‑site scripting. Mitigation reduces the potential for data theft and session hijacking.
