CVE-2026-118166

Name of the Vulnerable Software and Affected Versions MC4WP: Mailchimp for WordPress versions prior to 4.15.0

Description Unauthenticated visitors can execute arbitrary registered shortcodes with attacker-chosen attributes. This occurs because the plugin uses the do shortcode() function on user-supplied input, failing to prevent request-derived values in dynamic content tags from being processed as shortcodes when a form is embedded using the block method. The severity of the impact depends on the specific shortcodes registered on the site, as some may expose sensitive data or perform unauthorized actions.

Recommendations Update MC4WP: Mailchimp for WordPress to version 4.15.0 or later.