Reflected Cross-Site Scripting in Mailchimp for WordPress Plugin by WordPress
CVE-2026-87917

6.1MEDIUM

Key Information:

Vendor: WordPress
Status: Mc4WP: Mailchimp For WordPress
Vendor: CVE Published:; 19 September 2026

What is CVE-2026-87917?

The Mailchimp for WordPress plugin is susceptible to a Reflected Cross-Site Scripting vulnerability originating from its 'data' Dynamic Content Tag. The issue arises from inadequate input sanitization and output escaping measures. This allows unauthenticated attackers to inject arbitrary scripts into web pages. If a user is persuaded to interact with a manipulated link, these scripts execute, potentially compromising user data and site integrity.

Affected Version(s)

MC4WP: Mailchimp for WordPress 0 <= 4.14.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://plugins.trac.wordpress.org/browser/mailchimp-for-...

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 19, 2026
Vulnerability Reserved
Sep 9, 2026

Credit

nism0

CVE-2026-87917 Data

JSON