A stored XSS flaw allows a contributor‑level user or higher to embed malicious scripts into a page that will run for any visitor of that page. The vulnerability originates from the plugin’s shortcodes where attributes such as autocomplete, label, placeholder, btn_text, success_msg, and error_msg are concatenated directly into HTML output without proper sanitization or escaping, as described in the plugin’s source code. The flaw can lead to theft of user credentials, defacement, or other client‑side attacks, compromising the confidentiality, integrity, and availability of the site’s data.

WordPress sites that have the Single Mailchimp plugin installed with a version of 1.4 or earlier. The plugin is released by Jonathan Robbrecht under the identifier jonathan-robrecht:Single Mailchimp.

The CVSS score of 6.4 indicates moderate severity. No EPSS data is available, but the lack of a KEV listing suggests that no widespread exploitation data exists as of this assessment. The attack requires authenticated access with contributor privileges or higher, and success depends on the attacker’s ability to create or edit page content that includes the vulnerable shortcode. Once embedded, the malicious script executes for all users who view the affected page.