Mailchimp Subscribe Forms
Monthly
Unauthenticated reflected or stored Cross-Site Scripting in the MailChimp Subscribe Forms WordPress plugin (versions 4.3.3 and below) allows remote, unauthenticated attackers to inject arbitrary JavaScript into pages viewed by authenticated users. Exploitation requires victim interaction (UI:R) but no attacker authentication, and carries a scope change (S:C), meaning the injected script executes in the victim's browser context outside the plugin's own sandbox. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Patchstack advisory confirms the vulnerability.
Unauthenticated reflected or stored Cross-Site Scripting in the MailChimp Subscribe Forms WordPress plugin (versions 4.3.3 and below) allows remote, unauthenticated attackers to inject arbitrary JavaScript into pages viewed by authenticated users. Exploitation requires victim interaction (UI:R) but no attacker authentication, and carries a scope change (S:C), meaning the injected script executes in the victim's browser context outside the plugin's own sandbox. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Patchstack advisory confirms the vulnerability.