CVE-2026-15000: Stored XSS in Connect Contact Form 7 and Mailchimp WordPress Plugin

Technical summary

The vulnerability stems from insufficient input sanitization and output escaping of Mailchimp merge field values within the plugin. An attacker can craft a contact form submission that includes JavaScript payload in fields mapped to Mailchimp merge fields. When stored in the plugin's database and later retrieved for administrator review via the Contact Lookup feature, the payload is not properly escaped before being rendered in the admin interface. This creates a stored XSS condition (CWE-79) where the malicious script executes in the context of the administrator's session whenever that contact record is accessed.

Business impact

This vulnerability poses a direct threat to administrator accounts and the integrity of WordPress sites using this plugin. Once an administrator triggers the stored XSS by accessing a Contact Lookup, an attacker gains the ability to execute arbitrary actions in the WordPress environment with administrative privileges—including account creation, data exfiltration, malware installation, or site defacement. The deferred execution (requiring admin interaction) provides a window for attack preparation and reduces immediate risk of mass exploitation, but successful attacks can result in full site compromise, data theft, and operational disruption.

Affected systems

All versions of the Connect Contact Form 7 and Mailchimp plugin up to and including version 0.9.78.06 are affected. This plugin is commonly used on WordPress sites that integrate contact forms with Mailchimp email marketing functionality. Organizations running WordPress with this plugin installed—particularly those accepting public contact submissions—are in scope.

Exploitability

This vulnerability is rated HIGH (CVSS 7.2) with a network-accessible attack vector requiring no authentication and no special conditions (AC:L). However, the practical exploitation requires two stages: first, an attacker must inject malicious payload via a contact form submission; second, an administrator must manually access the Contact Lookup feature for that submission. The requirement for administrative interaction to trigger execution raises the bar compared to direct stored XSS, but does not eliminate the risk—many organizations regularly process contact inquiries. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities catalog.

Remediation

Organizations must immediately upgrade the Connect Contact Form 7 and Mailchimp plugin to a patched version released after 0.9.78.06. Verify the patched version against the official plugin repository or vendor advisory to confirm the fix addresses input sanitization and output escaping of Mailchimp merge fields. In the interim, consider disabling the Mailchimp merge field feature or restricting the Contact Lookup function to trusted staff members only if an immediate upgrade is not feasible.

Patch guidance

Visit the official WordPress plugin repository or the vendor's website to obtain the latest version of Connect Contact Form 7 and Mailchimp. Confirm that the updated version is released after 0.9.78.06 and explicitly addresses CWE-79 remediation for Mailchimp merge field handling. Apply the update through the WordPress admin dashboard (Plugins > Installed Plugins > Update) or manually via FTP/SFTP. After patching, perform a test submission through the contact form and verify that no stored scripts execute when an administrator accesses the Contact Lookup feature. Consider running a security scan to identify any previously stored payloads that may have been injected.

Detection guidance

Monitor WordPress admin logs and web server access logs for unusual contact form submissions containing special characters, JavaScript syntax, or script tags (e.g., `<script>`, `onerror=`, `onload=`). Use WordPress security plugins (e.g., Wordfence, Sucuri) to flag submissions with suspicious content. Inspect the plugin's database tables for stored entries containing unescaped HTML or JavaScript in Mailchimp merge field columns. Check browser developer console logs in the admin panel for JavaScript errors that may indicate failed script injection attempts. Alert on any Contact Lookup operations performed by administrator accounts, particularly those accessing newly submitted forms.

Why prioritize this

This vulnerability warrants immediate remediation due to its HIGH CVSS score and the potential for administrator account compromise. While the attack requires two-stage execution (injection plus admin interaction), the prevalence of contact forms on WordPress sites and the frequency with which administrators review submissions creates realistic exploitation scenarios. The ability to escalate from unauthenticated web submission to administrative code execution poses a direct and material risk to site integrity and data security.

Risk score, explained

The CVSS 7.2 HIGH rating reflects a network-accessible vulnerability with low attack complexity and no authentication requirement, resulting in compromised integrity and confidentiality of the web application. The score does not discount the requirement for administrator interaction to trigger execution; that factor is context-dependent rather than part of the base metric. The true risk is elevated by the plugin's widespread use and the common administrative practice of regularly accessing submitted contact information.

Frequently asked questions