What is the CVSS score of CVE-2026-15052?

CVE-2026-15052 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of MailChimp Subscribe Form are affected by CVE-2026-15052?

The MailChimp Subscribe Form and Form Builder WordPress plugin (versions through 4.3.3) contains a stored cross-site scripting vulnerability affecting millions of installations worldwide.

How to fix or mitigate CVE-2026-15052?

Within 24 hours: Identify and either disable affected plugin versions (4.3.3 and earlier) or restrict form submissions to authenticated users only across all WordPress installations. Within 7 days: Deploy web application firewall rules to detect and block XSS patterns in form inputs, audit form submission logs and databases for evidence of stored malicious payloads, and notify users if compromise is identified. Within 30 days: Monitor vendor security advisories for patch availability; if no patch is released by day 30, initiate migration to alternative form builder plugins with active security maintenance.

MailChimp Subscribe Form CVE-2026-15052

EUVD-2026-51759 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-01 Wordfence

GHSA-4qrg-84mv-738w

WordPress XSS Wordpress Plugin Mailchimp Subscribe Form Optin Builder Popup Builder Form Builder

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

UI:R corrected from provided UI:N because payload execution requires a victim to visit the injected page; all other metrics align with unauthenticated network submission and cross-context script execution.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 01, 2026 - 08:53 vuln.today

CVE Published

Aug 01, 2026 - 07:49 cve.org

HIGH 7.2

DescriptionCVE.org

The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Values in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder WordPress plugin (all versions through 4.3.3) allows unauthenticated network attackers to plant arbitrary JavaScript via form field values submitted to the plugin's form endpoints. The payload is persisted to the database and fires in any authenticated or unauthenticated user's browser upon visiting the injected page, with scope change confirmed by CVSS S:C. No active exploitation has been confirmed by CISA KEV, but Wordfence's disclosure includes direct references to the vulnerable source lines, effectively providing a functional roadmap to exploitation. The EPSS probability is not provided in the source data.

Technical ContextAI

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored variant. The root cause is dual: insufficient sanitization of user-supplied form field values on ingestion and absent or inadequate output escaping when those values are later rendered. Per the CPE string (cpe:2.3:a:umarbajwa:mailchimp_subscribe_form,_optin_builder,_popup_builder,_form_builder:*:*:*:*:*:*:*:*), the affected product is the 'mailchimp-subscribe-sm' plugin authored by umarbajwa. Wordfence's references point to three distinct vulnerable code paths: extension.php at lines 127 and 179 (form-builder-database integration) and ajax-requests-class.php at lines 906, 1224, and 2311, indicating the flaw is not isolated to one code path but spans both the form storage layer and the AJAX handler layer. This breadth increases the likelihood that multiple form interaction types are exploitable.

RemediationAI

The WordPress plugin SVN changeset referenced at https://plugins.trac.wordpress.org/changeset?reponame=&old=3627272%40mailchimp-subscribe-sm&new=3627272%40mailchimp-subscribe-sm indicates that a code-level fix has been committed upstream. However, the exact version number of the patched release is not confirmed in the available data - users should update to the latest version available in the WordPress plugin repository beyond 4.3.3 and verify the installed version is newer than 4.3.3 after update. If an immediate plugin update is not possible, the compensating controls are: (1) deactivate the plugin entirely until patching is feasible - this eliminates the attack surface at the cost of losing MailChimp subscription functionality; (2) restrict access to pages containing plugin forms to authenticated users only using a WAF or server-level IP restriction if the subscription audience permits it - this raises the attacker's privilege bar but prevents public subscriber capture; (3) deploy a WAF rule targeting script injection patterns in POST parameters submitted to the plugin's AJAX endpoints (wp-admin/admin-ajax.php with plugin-specific action values). Each compensating control carries a business trade-off against subscription form availability.