CVE-2026-87917: Mailchimp for WordPress XSS Vulnerability

CVE-2026-87917 Overview

CVE-2026-87917 is a Reflected Cross-Site Scripting (XSS) vulnerability in the MC4WP: Mailchimp for WordPress plugin. The flaw affects all versions up to and including 4.14.0 and stems from insufficient input sanitization and output escaping in the data Dynamic Content Tag. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when the victim clicks a crafted link. The issue is tracked under CWE-79 and was assigned to the WordPress ecosystem's most widely deployed Mailchimp integration plugin.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the context of a targeted user's session, enabling session theft, credential harvesting, and administrative account takeover if an administrator is tricked into clicking a malicious link.

Affected Products

MC4WP: Mailchimp for WordPress plugin versions up to and including 4.14.0
WordPress sites using the plugin's Dynamic Content Tags feature
Any site rendering the data tag in forms or pages

Discovery Timeline

2026-09-19 - CVE-2026-87917 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-87917

Vulnerability Analysis

The vulnerability resides in the MC4WP plugin's Dynamic Content Tag processing logic. The plugin supports a templating system that substitutes tags such as {data key="..."} with runtime values sourced from request context. When the data tag processes attacker-controlled input, the output is rendered into HTML without sufficient sanitization or contextual escaping. This allows arbitrary script content supplied via URL parameters to be reflected into the rendered page and executed by the browser.

Because the injection is reflected, exploitation requires user interaction — typically a victim clicking a crafted URL. The impacted code paths are visible in the plugin's class-dynamic-content-tags.php and class-form-tags.php files at tag 4.14.0. Review the WordPress Mailchimp Class Code and WordPress Mailchimp Form Class for the pre-patch handlers.

Root Cause

The root cause is missing output escaping. Values retrieved through the data Dynamic Content Tag are concatenated into HTML output without applying a WordPress escaping function such as esc_html(), esc_attr(), or wp_kses(). Because the tag accepts unauthenticated request data, any attribute-driven lookup can return attacker-controlled strings that break out of the intended HTML context.

Attack Vector

An unauthenticated attacker crafts a URL targeting a page that renders a MC4WP form or content containing the data tag. The URL embeds a payload in a parameter the data tag references. When a victim loads the link, the plugin substitutes the payload into the page, and the browser executes the injected JavaScript under the site's origin. If the victim is a logged-in administrator, the payload can perform privileged actions such as creating users, modifying plugins, or exfiltrating cookies.

No verified proof-of-concept code is currently published. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-87917

Indicators of Compromise

HTTP GET requests to WordPress pages containing MC4WP forms with query parameters holding <script>, javascript:, onerror=, or URL-encoded equivalents.
Web server access logs showing referrers from external domains linking to internal WordPress pages with unusual query strings.
Unexpected outbound requests from browsers after visiting site pages, indicating exfiltration to attacker infrastructure.
Creation of new WordPress administrator accounts or plugin installations shortly after a suspicious click event.

Detection Strategies

Inspect web application firewall (WAF) telemetry for reflected XSS signatures targeting URLs that render MC4WP forms or shortcodes.
Correlate WordPress wp-admin audit events with immediately preceding user visits containing suspicious query strings.
Deploy Content Security Policy (CSP) reporting to capture inline script violations originating from MC4WP-rendered pages.

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward logs to a centralized analytics platform for pattern matching on reflected payloads.
Alert on requests whose parameters contain HTML entities, script tags, or event handlers targeting pages with MC4WP shortcodes.
Monitor plugin version inventory across all WordPress installations to identify hosts still running 4.14.0 or earlier.

How to Mitigate CVE-2026-87917

Immediate Actions Required

Upgrade MC4WP: Mailchimp for WordPress to version 4.14.1 or later on every affected WordPress instance.
Audit administrator accounts and reset credentials for any accounts that may have clicked untrusted links during the exposure window.
Enable WAF rules that block reflected XSS payloads targeting query parameters processed by the plugin.

Patch Information

The plugin maintainers addressed the issue in version 4.14.1. The fix adds proper escaping to the Dynamic Content Tag output. Review the diff between vulnerable and patched revisions in WordPress Changeset 4.14.1 and the follow-up WordPress Changeset 4.14.1.

Workarounds

Temporarily disable the MC4WP plugin on sites where immediate patching is not possible.
Remove or restrict use of the data Dynamic Content Tag from public-facing forms and pages.
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Configure WAF rules to strip or block query parameters containing HTML or JavaScript syntax on pages that render MC4WP forms.

bash

# Update the plugin using WP-CLI
wp plugin update mailchimp-for-wp --version=4.14.1

# Verify the installed version
wp plugin get mailchimp-for-wp --field=version