CVE-2026-27536 describes an unauthenticated Cross Site Scripting (XSS) vulnerability affecting MailChimp Subscribe Forms versions <= 4.3.3. The flaw allows attackers to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed, with low confidentiality, integrity, and availability impacts.

Successful exploitation could allow attackers to execute arbitrary scripts in the context of users interacting with the vulnerable MailChimp Subscribe Forms, potentially leading to information disclosure, session hijacking, or other client-side impacts. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor vendor communications for updates and apply patches once available.