Mailmunch

CVE-2026-81783 Sep 10, 14:23 HIGH This Week

Subscriber-level broken authentication in the MailMunch - Grow your Email List WordPress plugin (versions ≤ 3.2.5) enables low-privileged authenticated users to bypass authentication controls, causing integrity and availability impacts on affected WordPress installations. The vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and reported by Patchstack, indicating a pathway or channel that circumvents the intended authentication mechanism. No public exploit code or active exploitation has been identified at time of analysis, though the network-accessible, low-complexity attack vector lowers the bar for abuse.

CVE-2026-7520 Aug 05, 07:39 HIGH This Week

MailChimp Forms by MailMunch (WordPress plugin) versions up to and including 3.2.7 allows any authenticated subscriber-level user to silently hijack the site's MailMunch account integration, redirecting all captured lead data to an attacker-controlled account. The missing capability check on the `sign_in()` and `sign_up()` AJAX handlers (CWE-862) means a low-privilege WordPress account is sufficient to relink the plugin to an attacker's own MailMunch account - after which every form submission is delivered to the attacker and the site's forms and landing pages are served from the attacker's MailMunch workspace. No public exploit code has been identified at time of analysis, but the attack surface is trivially accessible to any authenticated user.

CVE-2023-40203 Dec 13, 15:15 MEDIUM This Month

Missing Authorization vulnerability in mailmunch MailChimp Forms by MailMunch mailchimp-forms-by-mailmunch allows Exploiting Incorrectly Configured Access Control Security Levels.1.4. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2024-8735 Nov 22, 06:15 MEDIUM PATCH This Month

The MailMunch - Grow your Email List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2024-8726 Nov 20, 07:15 MEDIUM PATCH This Month

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to,. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2024-9614 Nov 13, 02:15 MEDIUM This Month

The Constant Contact Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2024-31378 Apr 15, 11:15 MEDIUM This Month

Cross-Site Request Forgery (CSRF) vulnerability in MailMunch MailChimp Forms by MailMunch.2.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2024-31349 Apr 07, 18:15 MEDIUM This Month

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MailMunch MailMunch - Grow your Email List allows Stored XSS.1.6. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-29793 Mar 27, 13:15 MEDIUM This Month

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MailMunch MailChimp Forms by MailMunch allows Stored XSS.2.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-22137 Jan 13, 00:15 MEDIUM This Month

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MailMunch Constant Contact Forms by MailMunch allows Stored XSS.0.11. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2023-45748 Oct 16, 11:15 HIGH This Week

Cross-Site Request Forgery (CSRF) vulnerability in MailMunch MailChimp Forms by MailMunch plugin <= 3.1.4 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2023-45647 Oct 16, 10:15 HIGH This Week

Cross-Site Request Forgery (CSRF) vulnerability in MailMunch Constant Contact Forms by MailMunch plugin <= 2.0.10 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2023-41852 Oct 10, 09:15 HIGH This Week

Cross-Site Request Forgery (CSRF) vulnerability in MailMunch MailMunch - Grow your Email List plugin <= 3.1.2 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.