Mailchimp for WordPress EUVD-2026-83559

Exploitation requires a page on the target site that renders the MC4WP 'data' dynamic content tag (via the plugin's dynamic-content/form-tag handling in class-dynamic-content-tags.php / class-form-tags.php) so that attacker-controlled request input is reflected into the page. The attacker is unauthenticated (PR:N) but MUST trick a user into clicking a crafted link or performing an action (UI:R) - this is reflected, not stored/persistent, so there is no unattended mass-exploitation path. Impact is limited to script execution in the victim's browser (C:L/I:L); limiting factors are the required user interaction, the need for a form/page using the affected dynamic tag, and that all versions up to and including 4.14.0 are affected while 4.14.1 remediates it.

This is a real but bounded issue. The CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is the canonical profile for a reflected XSS: network-reachable, low complexity, no privileges (PR:N confirms unauthenticated), but requiring victim user interaction (UI:R) and yielding only limited confidentiality/integrity impact (C:L/I:L) with a scope change (S:C) reflecting script execution in the victim's browser context rather than the server. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis.' Reflected XSS is not automatable at scale (each hit needs a separately social-engineered victim), which is why such flaws rarely reach KEV despite being genuinely exploitable. Net: prioritize patching because the affected plugin is extremely widely deployed and the flaw is unauthenticated, but treat it as a moderate - not critical - priority; there is no evidence of active or automated exploitation. The reporting source (Wordfence) and the trac changeset showing the fix (4.14.1) corroborate the vulnerability and patch, so the core facts are well-supported.

An attacker crafts a URL pointing at a page containing an MC4WP form that renders the 'data' dynamic content tag, embedding a malicious script payload in the request parameter that the tag reflects unsanitized. The attacker distributes this link via phishing or a malicious post; when a logged-in administrator or any visitor clicks it, the script executes in their browser session in the site's origin, enabling session/cookie theft or admin-action forgery. No public POC was identified, and successful exploitation depends on the victim performing the interaction (UI:R).