CVE-2026-8868

Name of the Vulnerable Software and Affected Versions Single Mailchimp plugin for WordPress versions prior to 1.5

Description Stored Cross-Site Scripting occurs via the 'single-mailchimp' shortcode. The issue stems from insufficient input sanitization and output escaping of user-supplied shortcode attributes autocomplete, label, placeholder, btn text, success msg, and error msg, which are concatenated directly into HTML output by the single mailchimp() function in shortcodes.php. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages that execute when accessed by other users.

Recommendations Update the plugin to a version later than 1.4. As a temporary mitigation, restrict contributor-level access to editing pages containing the 'single-mailchimp' shortcode.