CVE-2026-15000

Name of the Vulnerable Software and Affected Versions Connect Contact Form 7 and Mailchimp versions prior to 0.9.78.07

Description Stored Cross-Site Scripting (XSS) occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts through Mailchimp Merge Field Values. The execution is deferred and only triggers when an administrator performs a Contact Lookup for the email address submitted via the CF7 form.

Recommendations Update the plugin to a version newer than 0.9.78.06.