Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-06
MC4WP: Mailchimp for WordPress - Security Vulnerability (CVE-2026-118166)
The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its dynamic content tags from being processed as shortcodes when a form is embedded with its block, allowing unauthenticated visitors to execute arbitrary registered shortcodes with attacker-chosen attributes. This requires the site owner to have added a request-derived tag to the form content and to embed the form with the block rather than the classic shortcode.
PLUGIN
MC4WP: Mailchimp for WordPress
CVE-2026-118166
Risk Score
Threat Entry
Updated 2026-09-21
MC4WP: Mailchimp for WordPress - Security Vulnerability (CVE-2026-87917)
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
MC4WP: Mailchimp for WordPress
CVE-2026-87917
Risk Score
Threat Entry
Updated 2026-10-12
MC4WP: Mailchimp for WordPress - Cross-Site Scripting (XSS) (CVE-2026-4561)
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields (e.g., 'text_subscribed', 'text_error') in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
MC4WP: Mailchimp for WordPress
CVE-2026-4561
Risk Score
Threat Entry
Updated 2026-06-17
MC4WP: Mailchimp for WordPress - Broken Access Control (CVE-2026-1781)
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.11.1. This is due to the plugin trusting the `_mc4wp_action` POST parameter without validation, allowing unauthenticated attackers to force the form to process unsubscribe actions instead of subscribe actions. This makes it possible for unauthenticated attackers to arbitrarily unsubscribe any email address from the connected Mailchimp audience via the `_mc4wp_action` parameter, granted they can obtain the form ID (which is publicly exposed in the HTML source).
PLUGIN
MC4WP: Mailchimp for WordPress
CVE-2026-1781
Risk Score
Threat Entry
Updated 2026-06-17
MC4WP: Mailchimp for WordPress - Cross-Site Scripting (XSS) (CVE-2024-8680)
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.9.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
MC4WP: Mailchimp for WordPress
CVE-2024-8680
Risk Score
Threat Entry
Updated 2026-06-17
MC4WP: Mailchimp for WordPress - Cross-Site Scripting (XSS) (CVE-2024-8850)
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email' parameter when a placeholder such as {email} is used for the field in versions 4.9.9 to 4.9.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
MC4WP: Mailchimp for WordPress
CVE-2024-8850
Risk Score