Mailchimp Top Bar Plugin Vulnerable to Reflected Cross-Site Scripting

CVE-2024-9210

Summary

The MC4WP: Mailchimp Top Bar plugin for WordPress is susceptible to reflected cross-site scripting (XSS) vulnerabilities due to improper handling of URLs through the add_query_arg function without adequate escaping. This flaw allows unauthenticated attackers the potential to inject arbitrary JavaScript into web pages viewed by users. When a user is tricked into clicking a malicious link, the injected scripts can be executed in their browser. This poses significant risks, including session hijacking and redirecting users to malicious sites. It’s crucial for users to assess their current version and consider immediate updates or implement security measures to protect against exploitation.

References