What is the CVSS score of CVE-2026-27536?

CVE-2026-27536 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of MailChimp Subscribe Forms are affected by CVE-2026-27536?

The MailChimp Subscribe Forms WordPress plugin (versions 4.3.3 and below) is vulnerable to unauthenticated cross-site scripting that allows attackers to hijack authenticated user sessions and steal…

How to fix or mitigate CVE-2026-27536?

Within 24 hours, identify all WordPress instances running MailChimp Subscribe Forms versions 4.3.3 or earlier and document the inventory. Within 7 days, apply one or more interim controls: deactivate the plugin if not mission-critical, restrict form access to administrators only, or deploy WAF rules to block JavaScript injection in form parameters. Within 30 days, monitor Patchstack and MailChimp security advisories for patch availability; prepare and execute a patching campaign once a vendor fix is released, or migrate to an alternative actively-maintained form plugin.

MailChimp Subscribe Forms CVE-2026-27536

EUVD-2026-57934 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-13 Patchstack

GHSA-9qcm-96gr-2cxq

WordPress XSS Wordpress Plugin Mailchimp Subscribe Forms Pluginops

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-delivered, no privileges required, single user interaction needed; scope changes to victim browser context with limited but real C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:03 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.

AnalysisAI

Unauthenticated reflected or stored Cross-Site Scripting in the MailChimp Subscribe Forms WordPress plugin (versions 4.3.3 and below) allows remote, unauthenticated attackers to inject arbitrary JavaScript into pages viewed by authenticated users. Exploitation requires victim interaction (UI:R) but no attacker authentication, and carries a scope change (S:C), meaning the injected script executes in the victim's browser context outside the plugin's own sandbox. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Patchstack advisory confirms the vulnerability.

Technical ContextAI

The affected product is the MailChimp Subscribe Forms plugin for WordPress, identified by CPE cpe:2.3:a:pluginops:mailchimp_subscribe_forms:*:*:*:*:*:*:*:* and developed by PluginOps. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates the root cause is insufficient sanitization or escaping of user-supplied input before it is rendered in HTML output. In WordPress plugins, this commonly manifests as unsanitized shortcode attributes, GET/POST parameters, or form field values being echoed back into the page. The scope change (S:C) in the CVSS vector indicates the injected script executes in the browser context of a different security principal than the plugin itself, consistent with classic reflected or stored XSS in a WordPress front-end form component.

RemediationAI

Update the MailChimp Subscribe Forms plugin to a version above 4.3.3 via the WordPress plugin dashboard or by downloading the patched release from the WordPress plugin repository. The Patchstack advisory (https://patchstack.com/database/wordpress/plugin/mailchimp-subscribe-sm/vulnerability/wordpress-mailchimp-subscribe-forms-plugin-4-3-3-cross-site-scripting-xss-vulnerability) should be consulted for the confirmed fixed version once published. If an immediate upgrade is not possible, a compensating control is to disable or deactivate the plugin until patched - note this will remove subscription form functionality from the site. Deploying a Web Application Firewall (WAF) rule targeting XSS patterns in plugin-specific parameters can reduce exposure but should not be treated as a permanent substitute for patching, as WAF bypass techniques are well-documented for generic XSS signatures.