The MailChimp Forms by MailMunch WordPress plugin suffers from a reflected cross-site scripting vulnerability due to improper neutralization of input in URL parameters. Specifically, the add_query_arg function is used without appropriate escaping, enabling attackers to inject malicious scripts that execute when a user interacts with a crafted URL. This affects all versions up to 3.2.3. The vulnerability allows an attacker to perform script injection without authentication, relying on social engineering to induce user interaction. The CVSS 3.1 base score is 6.1 (medium), with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality and integrity with no impact on availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal user credentials, hijack user sessions, or perform actions on behalf of the user. The impact is limited to confidentiality and integrity, with no direct availability impact. Since the attack requires user interaction, exploitation depends on social engineering.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable plugin or applying manual mitigations such as input validation or escaping if feasible. Monitor official MailMunch and WordPress plugin channels for updates.