Reflected Cross-Site Scripting Vulnerability in Forms for Mailchimp by Optin Cat

CVE-2024-8870

Summary

The Forms for Mailchimp plugin by Optin Cat for WordPress is susceptible to Reflected Cross-Site Scripting (XSS) attacks, primarily due to the inadequate escaping of URLs via the add_query_arg function. This vulnerability impacts all versions up to and including 2.5.6 and allows unauthorized users to inject malicious scripts into web pages. By tricking victims into clicking a specially crafted link, attackers can execute arbitrary scripts in the context of the user's session, potentially leading to data theft, account compromise, or other malicious activities.

References