{"error":0,"message":null,"data":{"name":"MC4WP: Mailchimp for WordPress","plugin":"mailchimp-for-wp","link":"https:\/\/wordpress.org\/plugins\/mailchimp-for-wp\/","latest":"1789543860","closed":0,"closed_reason":null,"closed_date":null,"vulnerability":[{"uuid":"a9e067271afbb763ec937642a2b05078f77967f03935ca8d5c723cf6967deade","name":"MC4WP: Mailchimp for WordPress [mailchimp-for-wp] < 4.1.8","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.1.8","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2017-18577","name":"CVE-2017-18577","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2017-18577","description":"[en] The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.","date":"2019-08-22"},{"id":"b9ce6db47b3db693b21dffa6c1faa6b4ff623c98","name":"Mailchimp For WP <= 4.1.7 - Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/mailchimp-for-wp\/mailchimp-for-wp-417-cross-site-scripting","description":"The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.","date":"2017-09-08"},{"id":"e0a6438d-d183-4e6c-845c-e88a9bb6f59b","name":"Mailchimp For WP &lt; 4.1.8 - XSS","link":"https:\/\/wpscan.com\/vulnerability\/e0a6438d-d183-4e6c-845c-e88a9bb6f59b","description":"The MC4WP: Mailchimp for WordPress WordPress plugin was affected by a XSS security vulnerability.","date":null}],"impact":{"cvss":{"version":"3.0","vector":"CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"6.1","severity":"m","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.0","vector":"CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"6.1","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"f6bf2580b376a511c8266cc16ec343c406eb91f8c7bc0976e5e5d1016d2779d6","name":"MC4WP: Mailchimp for WordPress [mailchimp-for-wp] < 4.0.11","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.0.11","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2016-10871","name":"CVE-2016-10871","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2016-10871","description":"[en] The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.","date":"2019-08-13"},{"id":"709aec6201c992e62d5a84ced8a9c0a756154e78","name":"MailChimp for WordPress <= 4.0.10 - Reflected Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/mailchimp-for-wp\/mailchimp-for-wordpress-4010-authenticated-cross-site-scripting","description":"The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.","date":"2016-12-13"},{"id":"45fce54e-2d0e-4cf2-a9b2-49faca5b2a94","name":"MailChimp for WordPress &lt;= 4.0.10 - Authenticated Cross-Site Scripting (XSS)","link":"https:\/\/wpscan.com\/vulnerability\/45fce54e-2d0e-4cf2-a9b2-49faca5b2a94","description":"The MC4WP: Mailchimp for WordPress WordPress plugin was affected by an Authenticated Cross-Site Scripting (XSS) security vulnerability.","date":null}],"impact":{"cvss":{"version":"3.0","vector":"CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"6.1","severity":"m","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.0","vector":"CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"6.1","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"f18bebf348d050806f7a0838c0265da372799f6f248479b8f6cd023194de9b57","name":"MC4WP: Mailchimp for WordPress [mailchimp-for-wp] < 4.8.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.8.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"55539caec6fdb93c7d70d62e9ca17bfa94697c13","name":"WordPress MC4WP plugin <= 4.8.4 - Unauthorised Actions via Cross-Site Request Forgery (CSRF) vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/mailchimp-for-wp\/vulnerability\/wordpress-mc4wp-plugin-4-8-4-unauthorised-actions-via-cross-site-request-forgery-csrf-vulnerability","description":"Unauthorised Actions via Cross-Site Request Forgery (CSRF) vulnerability discovered by WPScanTeam in WordPress MC4WP plugin (versions <= 4.8.4).","date":"2021-06-01"}],"impact":[]},{"uuid":"4fd57e376b52431a56009430d2b4ac8b893958933cbd85878e8270cdea17992a","name":"MC4WP: Mailchimp for WordPress [mailchimp-for-wp] < 4.8.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.8.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"98f1ca3607dcd063fd77589054759e342ed6a125","name":"WordPress MC4WP plugin <= 4.8.4 - Authenticated Arbitrary Redirect vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/mailchimp-for-wp\/vulnerability\/wordpress-mc4wp-plugin-4-8-4-authenticated-arbitrary-redirect-vulnerability","description":"Authenticated Arbitrary Redirect vulnerability discovered by WPScanTeam in WordPress MC4WP plugin (versions <= 4.8.4).","date":"2021-06-01"}],"impact":[]},{"uuid":"6c03e17dde5b2898a85bf73ec7988757ca777b0bd5f59ecc841266dd6424f7d6","name":"MC4WP: Mailchimp for WordPress [mailchimp-for-wp] < 4.8.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.8.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2021-36833","name":"CVE-2021-36833","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2021-36833","description":"[en] Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ibericode's MC4WP plugin <= 4.8.6 at WordPress.","date":"2022-05-20"},{"id":"1aa72506551441626643b2aec3bc7f9e1ed24b15","name":"MC4WP: Mailchimp for WordPress <= 4.8.6 - Authenticated (Admin+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/mailchimp-for-wp\/mc4wp-mailchimp-for-wordpress-486-authenticated-admin-stored-cross-site-scripting","description":"The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 4.8.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2022-03-02"},{"id":"da04b514-a561-4d25-95b8-1c7b5597f093","name":"MC4WP &lt; 4.8.7 - Admin+ Stored Cross-Site Scripting","link":"https:\/\/wpscan.com\/vulnerability\/da04b514-a561-4d25-95b8-1c7b5597f093","description":"The plugin does not properly sanitise form data, which could allow high privilege users to perform Cross-Site Scripting attacks when unfiltered_html is disallowed","date":null},{"id":"bda3306f5f6b13e08d93459cf53c291de2fe3fa8","name":"WordPress  MC4WP Plugin  <= 4.8.6 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/mailchimp-for-wp\/vulnerability\/wordpress-mc4wp-plugin-4-8-6-authenticated-stored-cross-site-scripting-xss-vulnerability","description":"Update the WordPress MC4WP plugin to the latest available version (at least 4.8.7).\nbugb hunter discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress MC4WP Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site.  This vulnerability has been fixed in version 4.8.7.","date":"2022-03-02"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"h","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"4.8","severity":"m","exploitable":"1.7","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"4.8","severity":"medium","av":"network","ac":"low","pr":"high","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"1.7","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"4cd9ade79c82cca438f531ee3469e665419e464451f6bea2fc5d51ae45f85d22","name":"MC4WP: Mailchimp for WordPress [mailchimp-for-wp] < 4.0.11","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.0.11","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"71140658e8dd27ad99215a01d547d3df9113cb28","name":"WordPress MailChimp Plugin <= 4.0.10 - Cross Site Scripting","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/mailchimp-for-wp\/vulnerability\/wordpress-mailchimp-plugin-4-0-10-cross-site-scripting","description":"This plugin is prone to a cross site scripting vulnerability.\nUpdate the plugin.","date":"2016-12-09"}],"impact":[]},{"uuid":"bd3525f25f13ef99da3550097b52ca5105ce380a958d74cfe77a66f2fddc4779","name":"MC4WP: Mailchimp for WordPress [mailchimp-for-wp] < 4.8.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.8.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"417ce1345dbba2eabf9b6aa7857f8554a76220a8","name":"MC4WP: Mailchimp for WordPress < 4.8.7 - Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/mailchimp-for-wp\/mc4wp-mailchimp-for-wordpress-487-cross-site-scripting","description":"The MC4WP: Mailchimp for WordPress for WordPress is vulnerable to Stored Cross-Site Scripting via the textarea form field in versions up to, and including, 4.8.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2022-03-02"}],"impact":[]},{"uuid":"66e6cb4854eb3447e5984e6f73f4c396d54782007b5fe188a903d2e94fe76fb6","name":"MC4WP: Mailchimp for WordPress [mailchimp-for-wp] < 4.8.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.8.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"1039844adb532000b474e1c8a860e6f968752ec7","name":"MC4WP: Mailchimp for WordPress <= 4.8.4 - Cross-Site Request Forgery","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/mailchimp-for-wp\/mc4wp-mailchimp-for-wordpress-484-cross-site-request-forgery","description":"The MC4WP: Mailchimp for WordPress for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.8.4. This is due to missing nonce validation on the 'listen_for_actions' function. This makes it possible for unauthenticated attackers to dismiss notices and delete log files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","date":"2021-06-01"}],"impact":[]},{"uuid":"5e469c5161710cbe549c89334a5cc0e78017c88b254ff9bd93f2b9ed45c27d68","name":"MC4WP: Mailchimp for WordPress [mailchimp-for-wp] < 4.8.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.8.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"077d6c39d93d4bdd7eebad8b956a071af033f3ae","name":"MC4WP: Mailchimp for WordPress <= 4.8.4 - Open Redirect","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/mailchimp-for-wp\/mc4wp-mailchimp-for-wordpress-484-open-redirect","description":"The MC4WP: Mailchimp for WordPress for WordPress is vulnerable to Open Redirection via the '_redirect_to ' parameter in versions up to, and including, 4.8.4. This makes it possible for unauthenticated attackers to arbitrarily redirect administrators via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","date":"2021-06-01"}],"impact":[]},{"uuid":"a737b901bb6b6c862403ae431723748da68ac19a83c18440e6362fdac3c21acb","name":"MC4WP: Mailchimp for WordPress [mailchimp-for-wp] < 4.1.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.1.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"6e5c7827bb1ab588098d0642abb4c8244f6406d8","name":"MC4WP: Mailchimp for WordPress <= 4.1.6 - Reflected Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/mailchimp-for-wp\/mc4wp-mailchimp-for-wordpress-416-reflected-cross-site-scripting","description":"The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the use of add_query_arg() in versions up to, and including, 4.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":"2019-11-09"}],"impact":[]},{"uuid":"504dbb1320e28f5744f46805e87245fe6f38c3d030e42de3d991554f2676d5f6","name":"MC4WP: Mailchimp for WordPress [mailchimp-for-wp] < 4.8.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.8.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"13d92715-b195-4b75-9a39-6935fcafb832","name":"MC4WP &lt; 4.8.7 - Admin+ Stored Cross-Site Scripting","link":"https:\/\/wpscan.com\/vulnerability\/13d92715-b195-4b75-9a39-6935fcafb832","description":"The plugin does not properly sanitise from data, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.","date":null}],"impact":[]},{"uuid":"55b5b5ec206eeac17ca5364d454f2235ad18ad3b18b78a298cec7a5c36c33527","name":"MC4WP: Mailchimp for WordPress [mailchimp-for-wp] < 4.8.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.8.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"9bd6daba-6b58-4b69-b137-f064701f636c","name":"MC4WP: Mailchimp for WordPress &lt; 4.8.5 - Authenticated Arbitrary Redirect","link":"https:\/\/wpscan.com\/vulnerability\/9bd6daba-6b58-4b69-b137-f064701f636c","description":"The plugin did not properly check for CSRF in some of its actions handled by the listen_for_actions method (hooked as admin_init), allowing attackers to make logged in users with the manage_options capability do unwanted actions and redirect them to an arbitrary website after","date":null}],"impact":[]},{"uuid":"7e26a614659183222ddbd327466f6ebc8d74002b8a083414094695c250cec73d","name":"MC4WP: Mailchimp for WordPress [mailchimp-for-wp] < 4.8.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.8.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"e84e1fa5-a947-4b2c-a134-19e9b07385b4","name":"MC4WP: Mailchimp for WordPress &lt; 4.8.5 - Unauthorised Actions via CSRF","link":"https:\/\/wpscan.com\/vulnerability\/e84e1fa5-a947-4b2c-a134-19e9b07385b4","description":"The plugin did not properly check for CSRF in some of its actions handled by the listen_for_actions method (hooked as admin_init), allowing attackers to make logged in users with the manage_options capability do unwanted actions such as empty the logs, dismiss notice and so on","date":null}],"impact":[]},{"uuid":"924792a73c74410d454bba0f8d6ecd0d784f3739ab20b53f54aff8643bf929aa","name":"MC4WP: Mailchimp for WordPress [mailchimp-for-wp] < 4.1.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.1.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"9d9bb5a6-ac66-43b9-8811-4490f5eaaa78","name":"MailChimp for WordPress &lt;= 4.1.6 - Authenticated Cross-Site Scripting (XSS)","link":"https:\/\/wpscan.com\/vulnerability\/9d9bb5a6-ac66-43b9-8811-4490f5eaaa78","description":"Usage of the output of add_query_arg() without escaping in various places in the WordPress Backend leads to reflected XSS vulnerability.","date":null}],"impact":[]},{"uuid":"c8e7c13084d59cfa79ecb2ea56ac3199f998f2716e9252f6dcf47417b64c7426","name":"MC4WP: Mailchimp for WordPress [mailchimp-for-wp] < 4.9.10","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.9.10","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-51682","name":"CVE-2023-51682","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-51682","description":"[en] Missing Authorization vulnerability in ibericode MC4WP.This issue affects MC4WP: from n\/a through 4.9.9.","date":"2024-06-11"},{"id":"13fc7e0c1ba8b91dab546b6dcd3cb27b8d9c459d","name":"WordPress  MC4WP Plugin  <= 4.9.9 is vulnerable to Broken Access Control","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/mailchimp-for-wp\/vulnerability\/wordpress-mc4wp-plugin-4-9-9-broken-access-control-vulnerability","description":"Update the WordPress MC4WP plugin to the latest available version (at least 4.9.10).\nRafie Muhammad (Patchstack) discovered and reported this Broken Access Control vulnerability in WordPress MC4WP Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 4.9.10.\nHave additional information or questions about this entry? Get in touch.","date":"2024-12-27"},{"id":"4b6f50a6fd847667dbf7f53ee905725313e2c9fa","name":"MC4WP <= 4.9.9 - Missing Authorization via listen","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/mailchimp-for-wp\/mc4wp-499-missing-authorization-via-listen","description":"The MC4WP plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'listen' function in versions up to, and including, 4.9.9. This makes it possible for unauthenticated attackers to preview unpublished forms.","date":"2023-12-27"},{"id":"60cd93a4-7639-45a5-b2a8-a8930fb05cc8","name":"MC4WP &lt; 4.9.10 - Unauthenticated Unpublished Form Preview","link":"https:\/\/wpscan.com\/vulnerability\/60cd93a4-7639-45a5-b2a8-a8930fb05cc8","description":"The plugin is vulnerable to unauthorized access of data due to a missing capability check on the &#039;listen&#039; function, allowing unauthenticated attackers to preview unpublished forms.","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"l","i":"n","a":"n","score":"5.3","severity":"m","exploitable":"3.9","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N","score":"5.3","severity":"medium","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"low","i":"none","a":"none","exploitable":"3.9","impact":"1.4"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"70d04680eeae81fddd83c10714ba1c89f9161cc9afb16e507fa4a7d98c9cb77f","name":"MC4WP: Mailchimp for WordPress [mailchimp-for-wp] >= 4.9.9 - <= 4.9.16","description":null,"operator":{"min_version":"4.9.9","min_operator":"ge","max_version":"4.9.16","max_operator":"le","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-8850","name":"CVE-2024-8850","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-8850","description":"[en] The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email' parameter when a placeholder such as {email} is used for the field in versions 4.9.9 to 4.9.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":"2024-09-19"},{"id":"2280560059b8014ea0fd9fe27c4c1d1a19c4d664","name":"MC4WP: Mailchimp for WordPress 4.9.9 - 4.9.16 - Reflected Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/mailchimp-for-wp\/mc4wp-mailchimp-for-wordpress-499-4916-reflected-cross-site-scripting","description":"The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email' parameter when a placeholder such as {email} is used for the field in versions 4.9.9 to 4.9.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":"2024-09-18"},{"id":"8c34f8d3b12258a4bba90b027d670c50403e81b4","name":"WordPress MC4WP Plugin 4.9.9 - 4.9.16 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/mailchimp-for-wp\/vulnerability\/wordpress-mc4wp-plugin-4-9-9-4-9-16-reflected-cross-site-scripting-vulnerability","description":"<p>WordPress MC4WP Plugin 4.9.9 - 4.9.16 is vulnerable to Cross Site Scripting (XSS)<\/p><p>Software: MC4WP<\/p><p>Link: https:\/\/wordpress.org\/plugins\/mailchimp-for-wp\/#developers<\/p><p>Affected Version 4.9.9 - 4.9.16<\/p>","date":"2024-09-19"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"6.1","severity":"m","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"6.1","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"60ca94e63657908cf2e193803b0f6e8b3cc61b80762f32deeb6166b0fb2dc7a0","name":"MC4WP: Mailchimp for WordPress [mailchimp-for-wp] < 4.9.17","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.9.17","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-8680","name":"CVE-2024-8680","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-8680","description":"[en] The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.9.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2024-09-21"},{"id":"34be6a50a9a4b771b743d7193772217fb7571636","name":"MailChimp for Wordpress <= 4.9.16 - Authenticated (Administrator+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/mailchimp-for-wp\/mailchimp-for-wordpress-4916-auhenticated-administrator-stored-cross-site-scripting","description":"The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.9.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2024-09-20"},{"id":"898840e56329c608de698543ba7439c5ec670ffa","name":"WordPress MC4WP Plugin <= 4.9.16 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/mailchimp-for-wp\/vulnerability\/wordpress-mailchimp-for-wordpress-plugin-4-9-16-authenticated-administrator-stored-cross-site-scripting-vulnerability","description":"<p>WordPress MC4WP Plugin <= 4.9.16 is vulnerable to Cross Site Scripting (XSS)<\/p><p>Software: MC4WP<\/p><p>Link: https:\/\/wordpress.org\/plugins\/mailchimp-for-wp\/#developers<\/p><p>Affected Version <= 4.9.16<\/p><p>Fixed in version 4.9.17 <\/p>","date":"2024-09-23"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"h","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"5.5","severity":"m","exploitable":"2.3","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:L\/I:L\/A:N","score":"5.5","severity":"medium","av":"network","ac":"low","pr":"high","ui":"none","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.3","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."},{"cwe":"CWE-80","name":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)","description":"The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as \"<\", \">\", and \"&\" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"fc2381e358a677c630c97bc3ade69a107d95a8be2d73458fa9e87be9d6a20126","name":"MC4WP: Mailchimp for WordPress [mailchimp-for-wp] < 4.12.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.12.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-1781","name":"MC4WP: Mailchimp for WordPress <= 4.11.1 - Missing Authorization to Unauthenticated Arbitrary Subscription Deletion","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-1781","description":"The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.11.1. This is due to the plugin trusting the `_mc4wp_action` POST parameter without validation, allowing unauthenticated attackers to force the form to process unsubscribe actions instead of subscribe actions. This makes it possible for unauthenticated attackers to arbitrarily unsubscribe any email address from the connected Mailchimp audience via the `_mc4wp_action` parameter, granted they can obtain the form ID (which is publicly exposed in the HTML source).","date":"0000-00-00"},{"id":"a6b2063f68f3d193f756fa9cebe7694495db06cf","name":"MC4WP: Mailchimp for WordPress <= 4.11.1 - Missing Authorization to Unauthenticated Arbitrary Subscription Deletion","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/mailchimp-for-wp\/mc4wp-mailchimp-for-wordpress-4111-missing-authorization-to-unauthenticated-arbitrary-subscription-deletion","description":"The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.11.1. This is due to the plugin trusting the `_mc4wp_action` POST parameter without validation, allowing unauthenticated attackers to force the form to process unsubscribe actions instead of subscribe actions. This makes it possible for unauthenticated attackers to arbitrarily unsubscribe any email address from the connected Mailchimp audience via the `_mc4wp_action` parameter, granted they can obtain the form ID (which is publicly exposed in the HTML source).","date":"2026-03-10"}],"impact":{"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"3ab2d73b3805380b83eae00ed9b1e91a768e4db22ddaa56b7956d4c5e4f44d1a","name":"MC4WP: Mailchimp for WordPress [mailchimp-for-wp] < 4.12.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.12.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-4561","name":"CVE-2026-4561","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-4561","description":"[en] The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields (e.g., 'text_subscribed', 'text_error') in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2026-08-22"},{"id":"a93ab8b106c7de50bd1b62d68ff6af0356a40b8c","name":"MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/mailchimp-for-wp\/mc4wp-mailchimp-for-wordpress-4120-authenticated-author-stored-cross-site-scripting-via-form-response-messages","description":"The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields (e.g., 'text_subscribed', 'text_error') in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2026-03-10"},{"id":"964ce19b04ce07d011d615f1113efd0460809c2d","name":"WordPress MC4WP Plugin <= 4.12.0 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/mailchimp-for-wp\/vulnerability\/wordpress-mc4wp-mailchimp-for-wordpress-plugin-4-12-0-authenticated-author-stored-cross-site-scripting-via-form-response-messages-vulnerability","description":"<p>WordPress MC4WP Plugin <= 4.12.0 is vulnerable to Cross Site Scripting (XSS)<\/p><p>Software: MC4WP<\/p><p>Fixed in version 4.12.1 <\/p><p>Affected Version <= 4.12.0<\/p><p>CVE: CVE-2026-4561<\/p>","date":"2026-08-27"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"6.4","severity":"m","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:L\/I:L\/A:N","score":"6.4","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"changed","c":"low","i":"low","a":"none","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"4860dd4b803fd40709eab4385eff636a559ee2da835194e75776ed995c8430fd","name":"MC4WP: Mailchimp for WordPress [mailchimp-for-wp] < 4.14.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.14.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-87917","name":"CVE-2026-87917","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-87917","description":"[en] The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":"2026-09-19"},{"id":"d12de9107078bbd7233468ca932bbb3b4a1b71ba","name":"MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/mailchimp-for-wp\/mc4wp-mailchimp-for-wordpress-4140-reflected-cross-site-scripting-via-data-dynamic-content-tag","description":"The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":"2026-08-21"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"6.1","severity":"m","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"6.1","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}}]},"updated":"1789802753"}