CVE-2026-87917— MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag
Quick assessment
Affected
dvankooten MC4WP: Mailchimp for WordPress
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MC4WP: Mailchimp for WordPress 插件在 4.14.0 及之前所有版本中，由于输入清理和输出转义不足，存在通过‘data’动态内容标签引发的反射型跨站脚本（Reflected Cross-Site Scripting）漏洞。这使得未认证的攻击者能够通过诱导用户执行某个操作（例如点击链接），将任意 Web 脚本注入到页面中，并在页面加载时执行。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-87917
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag
Source: CVE Program / CVE List V5
Vulnerability Description
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| dvankooten | MC4WP: Mailchimp for WordPress | 0 ~ 4.14.0 | - |
|
II. Public POCs for CVE-2026-87917
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-87917
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-87917 (2)
Vendor Pages for CVE-2026-87917 (3)
Other References for CVE-2026-87917 (1)
IV. Related Vulnerabilities
Same product: MC4WP: Mailchimp for WordPress
-
CVE-2026-4561
MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Au -
CVE-2026-1781
MC4WP: Mailchimp for WordPress <= 4.11.1 - Missing Authoriza -
CVE-2024-8680
MailChimp for Wordpress <= 4.9.16 - Authenticated (Administr -
CVE-2024-8850
MC4WP: Mailchimp for WordPress 4.9.9 - 4.9.16 - Reflected Cr -
CVE-2021-36833
WordPress MC4WP plugin <= 4.8.6 - Authenticated Stored Cross
Same vendor: dvankooten
-
CVE-2026-4561
MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Au -
CVE-2026-1781
MC4WP: Mailchimp for WordPress <= 4.11.1 - Missing Authoriza -
CVE-2024-9704
Social Sharing (by Danny) <= 1.3.7 - Authenticated (Contribu -
CVE-2024-9210
MC4WP: Mailchimp Top Bar <= 1.6.0 - Reflected Cross-Site Scr -
CVE-2024-8662
Koko Analytics <= 1.3.12 - Reflected Cross-Site Scripting
Same weakness: CWE-79
-
CVE-2026-76579
LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via -
CVE-2026-1256
YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Missi -
CVE-2026-8354
Gum Addon for Elementor <= 1.3.15 - Authenticated (Contribut -
CVE-2026-5410
Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stor -
CVE-2026-15098
Real 3D Flipbook <= 5.1.1 - Authenticated (Contributor+) Sto
V. Comments for CVE-2026-87917
No comments yet