CVE-2026-4561: MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields (e.g., 'textsubscribed', 'texterror') in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mc4wp/mailchimp-for-wordpressto a version that resolves this vulnerability.Fixed in 4.12.0
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
An attacker must be authenticated to WordPress with an Author role or higher. They need the ability to modify the affected form response message post meta fields, such as text_subscribed or text_error.
Who can be affected by a successful exploit?
Any user who accesses a page containing an injected form can have attacker-supplied scripts execute in their browser. The vulnerability can affect confidentiality and integrity in the context of the viewing user's session.
Which plugin versions are affected?
All MC4WP: Mailchimp for WordPress versions up to and including 4.12.0 are affected. The provided information does not identify a fixed version.
How can I check whether my site may be affected?
Check whether the installed plugin version is 4.12.0 or earlier, then review form response message fields such as text_subscribed and text_error for unexpected HTML or script content. Also review Author-and-higher accounts and recent changes to form configuration.