Stored Cross-Site Scripting in MailerLite Signup Forms Plugin for WordPress

CVE-2025-13993

What is CVE-2025-13993?

The MailerLite Signup Forms plugin for WordPress is susceptible to stored cross-site scripting attacks due to inadequate input sanitization and output escaping mechanisms. This vulnerability allows authenticated users with administrator privileges or higher to inject malicious scripts into the 'form_description' and 'success_message' fields. When these fields are rendered on web pages, the injected scripts execute in the context of users who visit those pages, potentially leading to the compromise of user sessions, phishing attacks, or information theft.

References