CVE-2026-15000 is a stored cross-site scripting vulnerability (CWE-79) in the rnzo Connect Contact Form 7 and Mailchimp plugin for WordPress. It affects all versions up to and including 0.9.78.06 due to insufficient input sanitization and output escaping of Mailchimp merge field values. An unauthenticated attacker can inject arbitrary web scripts that execute when an administrator performs a Contact Lookup on the injected entry. This deferred execution targets privileged users, potentially leading to credential theft or session hijacking. No official patch or remediation level has been disclosed at this time.

The vulnerability allows unauthenticated attackers to inject persistent malicious scripts into pages viewed by administrators during Contact Lookup operations. This can lead to the compromise of administrator accounts or other privileged actions through script execution in the administrator's browser context. The impact is limited to scenarios where an administrator interacts with the injected data, reducing immediate exploitation risk but still posing a significant threat to administrative security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and avoid performing Contact Lookup operations on untrusted or suspicious email entries. Monitor for updates from the vendor regarding patches or official mitigations.