An unauthenticated Stored Cross-Site Scripting vulnerability in the MailChimp Subscribe Form plugin allows attackers to inject malicious scripts into form fields, potentially compromising user sessions.

This is a Stored Cross-Site Scripting (XSS) vulnerability caused by improper neutralization of user-supplied input within form field values. The vulnerability is exploitable by unauthenticated remote attackers.

The vulnerability allows for the execution of arbitrary JavaScript in the browser of a victim, such as a WordPress administrator. Successful exploitation could lead to session hijacking, unauthorized administrative actions, or the redirection of users to malicious sites, severely impacting the integrity and security of the WordPress instance. The CVSS score of 7.2 reflects the high risk associated with this unauthenticated remote access vector.

Immediate Action: Update the MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin to version 4.3.4 or later.

Proactive Monitoring: Monitor WordPress administrative access logs for suspicious activity or unauthorized script execution patterns originating from form submissions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common XSS payloads and malicious script injections in POST requests.

Public Exploit Available: No

Given the ease of exploitation and the potential for full administrative account takeover, organizations using this plugin must prioritize the update to version 4.3.4 immediately. Failure to patch leaves the platform exposed to potential cross-site scripting attacks that can compromise sensitive user data and site configuration.