Mc4Wp
Monthly
Stored XSS in the MC4WP: Mailchimp for WordPress plugin allows authenticated WordPress users with Author-level access or above to inject persistent malicious scripts into form response message post meta fields (`text_subscribed`, `text_error`), affecting all versions through 4.12.0. Injected payloads execute in the browsers of any site visitor who loads a page rendering the compromised form response, enabling session hijacking, credential theft, or malicious redirects against other users including Administrators. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV, though the low privilege barrier of the Author role makes this a credible internal threat on multi-contributor WordPress installations.
Stored XSS in the MC4WP: Mailchimp for WordPress plugin allows authenticated WordPress users with Author-level access or above to inject persistent malicious scripts into form response message post meta fields (`text_subscribed`, `text_error`), affecting all versions through 4.12.0. Injected payloads execute in the browsers of any site visitor who loads a page rendering the compromised form response, enabling session hijacking, credential theft, or malicious redirects against other users including Administrators. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV, though the low privilege barrier of the Author role makes this a credible internal threat on multi-contributor WordPress installations.