Skip to content
OpenAdvisories

Vendor

dvankooten

8 known vulnerabilities.

Products

MC4WP: Mailchimp for WordPress 5 Koko Analytics – Privacy Friendly Statistics for WordPress 1 MC4WP: Mailchimp Top Bar 1 Social Sharing (by Danny) 1
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-87917

    MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag

    The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possi…

    dvankooten MC4WP: Mailchimp for WordPress Web / CMS
  • Medium 6.4
    CVE-2026-4561

    MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages

    The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields (e.g., 'text_subscribed', 'text_error') in all versions up to, and including, 4.12.0 due to insufficient input …

    dvankooten MC4WP: Mailchimp for WordPress Web / CMS
  • Medium 6.5
    CVE-2026-1781

    MC4WP: Mailchimp for WordPress <= 4.11.1 - Missing Authorization to Unauthenticated Arbitrary Subscription Deletion

    The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.11.1. This is due to the plugin trusting the `_mc4wp_action` POST parameter without validation, allowing unauthenticated att…

    dvankooten MC4WP: Mailchimp for WordPress Web / CMS
  • Medium 6.4
    CVE-2024-9704

    Social Sharing (by Danny) <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Social Sharing (by Danny) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dvk_social_sharing' shortcode in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping on user supp…

    dvankooten Social Sharing (by Danny) Web / CMS
  • Medium 6.1
    CVE-2024-9210

    MC4WP: Mailchimp Top Bar <= 1.6.0 - Reflected Cross-Site Scripting

    The MC4WP: Mailchimp Top Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.6.0. This makes it possible for unauthenticated a…

    dvankooten MC4WP: Mailchimp Top Bar Web / CMS
  • Medium 6.1
    CVE-2024-8662

    Koko Analytics <= 1.3.12 - Reflected Cross-Site Scripting

    The Koko Analytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.3.12. This makes it possible for unauthenticated attackers …

    dvankooten Koko Analytics – Privacy Friendly Statistics for WordPress Web / CMS
  • Medium 4.4
    CVE-2024-8680

    MailChimp for Wordpress <= 4.9.16 - Authenticated (Administrator+) Stored Cross-Site Scripting

    The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.9.16 due to insufficient input sanitization and output escaping. This makes it possible for authent…

    dvankooten MC4WP: Mailchimp for WordPress Web / CMS
  • Medium 6.1
    CVE-2024-8850

    MC4WP: Mailchimp for WordPress 4.9.9 - 4.9.16 - Reflected Cross-Site Scripting

    The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email' parameter when a placeholder such as {email} is used for the field in versions 4.9.9 to 4.9.16 due to insufficient input sanitization and o…

    dvankooten MC4WP: Mailchimp for WordPress Web / CMS