The 'Forms for Mailchimp by Optin Cat – Grow Your MailChimp List' WordPress plugin suffers from a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation. Specifically, the form color parameters are not properly sanitized or escaped, enabling authenticated attackers with editor privileges to inject arbitrary JavaScript code. This code executes in the context of users who access the compromised pages, potentially leading to data theft or session hijacking. The vulnerability affects all versions up to and including 2.5.7. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, and partial impact on confidentiality and integrity.

An attacker with editor-level access can exploit this vulnerability to inject persistent malicious scripts into pages generated by the plugin. When other users access these pages, the injected scripts execute in their browsers, potentially leading to unauthorized actions such as data theft or session compromise. The impact is limited to confidentiality and integrity with no availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict editor-level access to trusted users only and consider disabling or removing the vulnerable plugin to prevent exploitation.