Medium · 4.8 CVE-2021-36833 EUVD-2021-23409GHSA-xhfm-f7f9-cpx6

WordPress MC4WP plugin <= 4.8.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Published May 20, 2022 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ibericode's MC4WP plugin <= 4.8.6 at WordPress.

Vendor	Product	Affected	Fixed
ibericode	MC4WP: Mailchimp for WordPress	<= 4.8.6 – ≤ 4.8.6	—