Stored Cross-Site Scripting in MailerLite Signup Forms Plugin for WordPress

CVE-2025-13993

What is CVE-2025-13993?

The MailerLite Signup Forms plugin for WordPress is susceptible to stored cross-site scripting attacks due to inadequate input sanitization and output escaping mechanisms. This vulnerability allows authenticated users with administrator privileges or higher to inject malicious scripts into the 'form_description' and 'success_message' fields. When these fields are rendered on web pages, the injected scripts execute in the context of users who visit those pages, potentially leading to the compromise of user sessions, phishing attacks, or information theft.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References