Advisories · Technology

dvankooten MC4WP: Mailchimp for WordPress.

Every CVE that names dvankooten MC4WP: Mailchimp for WordPress among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-87917 CVE record

CVSS 6.1 Medium

MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag
- dvankooten MC4WP: Mailchimp for WordPress
- Cross-site scripting (XSS)
Not analysed yet 19 Sept 2026
CVE-2026-4561 CVE record

CVSS 6.4 Medium

MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages
- dvankooten MC4WP: Mailchimp for WordPress
- Cross-site scripting (XSS)
Not analysed yet 22 Aug 2026
CVE-2026-1781 CVE record

CVSS 6.5 Medium

MC4WP: Mailchimp for WordPress <= 4.11.1 - Missing Authorization to Unauthenticated Arbitrary Subscription Deletion
- dvankooten MC4WP: Mailchimp for WordPress
- Broken access control
Not analysed yet 11 Mar 2026
CVE-2024-8680 CVE record

CVSS 4.4 Medium

MailChimp for Wordpress <= 4.9.16 - Authenticated (Administrator+) Stored Cross-Site Scripting
- dvankooten MC4WP: Mailchimp for WordPress
- Cross-site scripting (XSS)
Not analysed yet 21 Sept 2024
CVE-2024-8850 CVE record

CVSS 6.1 Medium

MC4WP: Mailchimp for WordPress 4.9.9 - 4.9.16 - Reflected Cross-Site Scripting
- dvankooten MC4WP: Mailchimp for WordPress
- Cross-site scripting (XSS)
Not analysed yet 19 Sept 2024