What is the CVSS score of CVE-2026-8868?

CVE-2026-8868 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Single Mailchimp CVE-2026-8868

EUVD-2026-32056 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-9fg9-3rfw-p3wx

XSS WordPress PHP

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:04 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Single Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'single-mailchimp' shortcode in all versions up to, and including, 1.4. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes (autocomplete, label, placeholder, btn_text, success_msg, error_msg) which are concatenated directly into HTML output by the single_mailchimp() function in shortcodes.php. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Single Mailchimp WordPress plugin (all versions through 1.4) allows authenticated attackers with contributor-level access to inject persistent JavaScript into WordPress pages via unsanitized shortcode attributes. The six affected attributes - autocomplete, label, placeholder, btn_text, success_msg, and error_msg - are concatenated directly into HTML output by the single_mailchimp() function in shortcodes.php without sanitization or output escaping. No public exploit code exists and EPSS places exploitation probability at 0.03% (9th percentile), indicating low real-world exploitation pressure at this time.

Technical ContextAI

The vulnerability resides in the single_mailchimp() PHP function defined in shortcodes.php (lines 9 and 23, per plugins.trac.wordpress.org source references). The function processes the [single-mailchimp] WordPress shortcode and renders a Mailchimp subscription form, directly embedding user-controlled shortcode attribute values into the HTML output without applying WordPress sanitization functions (e.g., esc_attr(), esc_html(), wp_kses()) or output escaping. CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) is the root cause: untrusted data enters a web page without sufficient validation, enabling script injection that persists in the database and executes in victim browsers. The CVSS Scope:Changed (S:C) metric confirms that successful exploitation crosses a security boundary - from the attacker's WordPress session into the victim user's browser security context.

RemediationAI

No vendor-released patched version is identified in the available intelligence data - affected versions are confirmed only through 1.4, and no explicit fix version is cited in the Wordfence advisory or EUVD entry. Administrators should check the WordPress plugin repository for an updated version of Single Mailchimp beyond 1.4 and apply any available update immediately. If no patch is available, the most effective compensating control is to deactivate and remove the Single Mailchimp plugin entirely, which eliminates the attack surface with no functional side effects beyond losing the Mailchimp form feature. If the plugin must remain active, restrict contributor-level and above role assignments to fully trusted users only, as this directly closes the attacker prerequisite. Additionally, deploying a Web Application Firewall rule targeting the [single-mailchimp] shortcode with script-containing attribute values (e.g., Wordfence's firewall rules for authenticated XSS) can provide a secondary layer of defense. Monitor the plugin's changelog at https://plugins.trac.wordpress.org/browser/single-mailchimp/trunk/shortcodes.php for source-level fixes.