The MC4WP: Mailchimp for WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) in all versions up to and including 4.12.0. The flaw arises from improper neutralization of input in form response message post meta fields, allowing authenticated attackers with Author-level privileges or higher to inject malicious scripts. These scripts execute in the context of users viewing the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability is rated medium severity with a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No known exploits are reported in the wild, and no vendor-provided patch or official remediation is documented at this time.

An attacker with Author-level or higher access can inject persistent malicious scripts into form response message fields. These scripts execute in the browsers of users who view the affected pages, potentially compromising confidentiality and integrity of user data. The vulnerability does not impact availability. The scope is changed as the vulnerability affects resources beyond the attacker’s privileges (S:C).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and consider manual sanitization or filtering of form response message inputs if feasible.