Threats tagged 'ghsa-7vpp-4gxp-3rx5'

The MC4WP: Mailchimp for WordPress plugin versions before 4.15.0 have a vulnerability where request-derived values in dynamic content tags are processed as shortcodes when a form is embedded using its block. This allows unauthenticated visitors to execute arbitrary registered shortcodes with attacker-chosen attributes, but only if the site owner has added a request-derived tag to the form content and uses the block embedding method instead of the classic shortcode.