Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-06
MC4WP: Mailchimp for - Security Vulnerability (CVE-2026-118167)
The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any other audience in the site's connected Mailchimp account.
PLUGIN
MC4WP: Mailchimp for
CVE-2026-118167
Risk Score
Threat Entry
Updated 2026-09-21
MC4WP: Mailchimp for - Security Vulnerability (CVE-2026-87917)
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
MC4WP: Mailchimp for
CVE-2026-87917
Risk Score
Threat Entry
Updated 2026-10-12
MC4WP: Mailchimp for - Cross-Site Scripting (XSS) (CVE-2026-4561)
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields (e.g., 'text_subscribed', 'text_error') in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
MC4WP: Mailchimp for
CVE-2026-4561
Risk Score