Jeg Elementor Kit < 2.5.7 - Unauthenticated Settings Update

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the...

CVE-2026-4561

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields e.g., 'textsubscribed', 'texterror' in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This mak...

EUVD-2026-64299

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields e.g., 'textsubscribed', 'texterror' in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-4561

The MC4WP: Mailchimp for WordPress plugin for WordPress is affected by a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 4.12.0 . The flaw resides in the form response message post meta fields (e.g., text_subscribed, text_error), caused by insufficient input sa...

CVE-2026-19699

The GutenKit WordPress plugin (versions 2.4.12–2.4.15 , before 2.5.0) contains an insufficient capability check on certain REST API endpoints . This allows authenticated users with the Contributor role or higher to retrieve mailing-list audience metadata from the site's connected Mailchimp market...

CVE-2026-19699 GutenKit 2.4.12 - 2.4.15 - Contributor+ Mailchimp Audience Data Disclosure

The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account...

CVE-2026-73346

Administrator SQL Injection in MailChimp For WooCommerce 6.2 versions...

CVE-2026-27536

Unauthenticated Cross Site Scripting XSS in MailChimp Subscribe Forms = 4.3.3 versions...

CVE-2026-73346 WordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerability

Administrator SQL Injection in MailChimp For WooCommerce 6.2 versions...

EUVD-2026-57911

Administrator SQL Injection in MailChimp For WooCommerce 6.2 versions...

CVE-2026-73346

The CVE concerns the WordPress plugin MailChimp For WooCommerce (affected: versions

CVE-2026-27536

The CVE-2026-27536 details an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress MailChimp Subscribe Forms plugin, versions

CVE-2026-27536 WordPress MailChimp Subscribe Forms plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in MailChimp Subscribe Forms = 4.3.3 versions...

EUVD-2026-57934

Unauthenticated Cross Site Scripting XSS in MailChimp Subscribe Forms = 4.3.3 versions...

PT-2026-71601

Administrator SQL Injection in MailChimp For WooCommerce 6.2 versions...

WordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MailChimp For WooCommerce versions 6.2...

WordPress MailChimp Subscribe Forms plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by HaiND in WordPress Plugin MailChimp Subscribe Forms versions = 4.3.3...

CVE-2026-7520 MailChimp Forms by MailMunch <= 3.2.7 - Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover via 'sign_in' AJAX Action

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the signin and signup AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2026-7520

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the signin and signup AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2026-15052

The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Values in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...