CVE-2026-15000 is a stored cross-site scripting vulnerability (CWE-79) in the rnzo Connect Contact Form 7 and Mailchimp WordPress plugin. It affects all versions up to and including 0.9.78.06. The vulnerability is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of Mailchimp merge field values. An unauthenticated attacker can inject arbitrary web scripts that are stored and later executed when an administrator performs a Contact Lookup for the submitted email address. This deferred execution targets privileged users and can lead to limited confidentiality and integrity impacts.

The vulnerability allows unauthenticated attackers to inject stored malicious scripts that execute in the context of an administrator's browser when they perform a Contact Lookup. This can lead to limited confidentiality and integrity impacts, such as theft of sensitive information or manipulation of administrative functions. There is no impact on availability. The CVSS v3.1 base score is 7.2 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and scope change.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated, users should monitor the vendor's communications for updates. Until a patch is available, restrict administrative access to trusted users only and avoid performing Contact Lookups on untrusted or suspicious entries to reduce risk.