MC4WP <=4.12.0 Stored XSS Vulnerability via Form Response Messages (CVE-2026-4561)

Vulnerability Overview Vulnerability Name: MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages CVE ID: CVE-2026-4561 CVSS Score: 6.4 (Medium) Release Date: August 21, 2026 Last Update Date: August 22, 2026 Researchers: Osvaldo Noe Gonzalez Del Rio (Oz) - krei.dev Affected Scope Software Type: Plugin Software Name: Mailchimp for WordPress Affected Versions: <= 4.12.0 Fixed Version: 4.12.1 Remediation Remediation Status: Yes Remediation Details: Update to version 4.12.1 or later patched versions Vulnerability Details Description: The MC4WP: Mailchimp for WordPress plugin contains a stored cross-site scripting (XSS) vulnerability. Attackers can inject arbitrary web scripts into the meta fields of form response messages (such as , ). When a user visits a page containing the injected script, the script will execute. Reference Links: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Recent Related Vulnerabilities MC4WP: Mailchimp for WordPress <= 4.11.1 - Missing Authorization to Unauthenticated Arbitrary Subscription Deletion - CVE ID: CVE-2026-1781 - CVSS Score: 6.5 - Researcher: Sarawut Pookhet (MotterHelo) - Date: March 10, 2026 MailChimp for WordPress <= 4.9.16 - Authenticated (Administrator) Stored Cross-Site Scripting - CVE ID: CVE-2024-8680 - CVSS Score: 4.4 - Researcher: Jorge Diaz (ddxax) - Date: September 20, 2024 MC4WP: Mailchimp for WordPress 4.9.9 - 4.9.16 - Reflected Cross-Site Scripting - CVE ID: CVE-2024-8850 - CVSS Score: 6.1 - Researcher: kausenawro - Date: September 18, 2024 MC4WP <= 4.9.9 - Missing Authorization via Iisten - CVE ID: CVE-2023-51682 - CVSS Score: 5.3 - Researcher: Rafie Muhammad - Date: December 27, 2023 MC4WP: Mailchimp for WordPress <= 4.8.6 - Authenticated (Admin+) Stored Cross-Site Scripting - CVE ID: CVE-2021-36833 - CVSS Score: 5.5 - Researcher: Asif Nowaz Minhas - Date: March 2, 2022 MC4WP: Mailchimp for WordPress <= 4.8.7 - Cross-Site Scripting - CVE ID: CVE-2021-36833 - CVSS Score: 5.5 - Researcher: Asif Nowaz Minhas - Date: March 2, 2022 MC4WP: Mailchimp for WordPress <= 4.8.4 - Cross-Site Request Forgery - CVE ID: CVE-2021-36833 - CVSS Score: 8.8 - Researcher: WPScanTeam - Date: June 1, 2021 MC4WP: Mailchimp for WordPress <= 4.8.4 - Open Redirect - CVE ID: CVE-2021-36833 - CVSS Score: 6.1 - Researcher: WPScanTeam - Date: June 1, 2021 MC4WP: Mailchimp for WordPress <= 4.1.6 - Reflected Cross-Site Scripting - CVE ID: CVE-2017-18577 - CVSS Score: 6.1 - Researcher: RIPS Technologies - Date: November 9, 2019 Mailchimp For WP <= 4.1.7 - Cross-Site Scripting - CVE ID: CVE-2017-18577 - CVSS Score: 6.1 - Researcher: RIPS Technologies - Date: September 8, 2017 Additional Information Wordfence Intelligence offers free personal and commercial API access to its comprehensive WordPress vulnerability database, along with free webhook integration to provide timely notifications when new vulnerabilities are added to the database. The Wordfence Intelligence WordPress Vulnerability Database is fully accessible and queryable for free. Please refer to the documentation to learn how to access and consume vulnerability data via the API. Contact Information Technical Support: wfi-support@wordfence.com Business Hours: 9am-8pm ET, 6am-6pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 1 hour Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved License: Defiant grants you a perpetual, worldwide, non-exclusive, royalty-free, irrevocable copyright license to copy, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy must include this license. Social Media Facebook: Wordfence Twitter: Wordfence LinkedIn: Wordfence Instagram: Wordfence Subscribe Subscribe: Subscribe for news and updates from experienced security professionals. Legal Statement Terms of Service: Terms of Service Privacy Policy and Notice at Collection: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Products Wordfence Free: Wordfence Free Wordfence Premium: Wordfence Premium Wordfence Care: Wordfence Care Wordfence Response: Wordfence Response Wordfence CLI: Wordfence CLI Wordfence Intelligence: Wordfence Intelligence Wordfence Central: Wordfence Central Support Documentation: Documentation Learning Center: Learning Center Free Support: Free Support Paid Support: Paid Support News Blog: Blog News: News Vulnerability Advisories: Vulnerability Advisories About About Wordfence: About Wordfence Affiliate Program: Affiliate Program Employment: Employment Contact: Contact Security: Security CVE Request Form: CVE Request Form Subscribe Subscribe: Subscribe for news and updates from experienced security professionals. Legal Statement Terms of Service: Terms of Service Privacy Policy and N

Goal Reached Thanks to every supporter — we hit 100%!

MC4WP <=4.12.0 Stored XSS Vulnerability via Form Response Messages (CVE-2026-4561)

More from this source