CVE-2026-8868 is a stored cross-site scripting vulnerability in the Single Mailchimp WordPress plugin by jonathan-robrecht. The issue arises from insufficient input sanitization and output escaping of user-supplied shortcode attributes (autocomplete, label, placeholder, btn_text, success_msg, error_msg) handled by the single_mailchimp() function in shortcodes.php. Authenticated attackers with contributor-level privileges or higher can inject arbitrary JavaScript into pages, which executes when those pages are accessed by users. This vulnerability affects all versions up to and including 1.4. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required at the contributor level.

An attacker with contributor-level access or higher can inject malicious scripts into pages via shortcode attributes. These scripts execute in the context of users viewing the infected pages, potentially leading to theft of session tokens, defacement, or other client-side impacts. The vulnerability does not affect availability but impacts confidentiality and integrity to a limited extent. No known exploits have been reported in the wild.

No official patch or remediation is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict contributor-level access to trusted users only and consider removing or disabling the Single Mailchimp plugin if possible to prevent exploitation.