CVE-2026-15052 is a stored cross-site scripting vulnerability (CWE-79) in the umarbajwa MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder WordPress plugin. The issue affects all versions up to and including 4.3.3 and is caused by improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of form field values. This allows unauthenticated attackers to inject malicious scripts that execute in the context of users visiting the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating network exploitable with low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with a scope change. No known exploits in the wild or vendor patches have been reported as of the published date.

Successful exploitation allows unauthenticated attackers to inject and store malicious scripts in form field values, which execute in the browsers of users who visit the affected pages. This can lead to partial confidentiality and integrity loss, such as theft of user data or manipulation of page content. There is no impact on availability. The vulnerability affects the security context of users accessing the injected content, potentially enabling session hijacking or other client-side attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting access to the vulnerable plugin functionality to prevent exploitation. Implementing web application firewalls (WAFs) with XSS filtering rules may provide temporary mitigation. Monitor vendor channels for updates or patches addressing this vulnerability.