What the vulnerability does
01Description
The Connect Contact Form 7 and Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mailchimp Merge Field Values in all versions up to, and including, 0.9.78.06 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is only triggered when a privileged user (Administrator) performs a Contact Lookup for the email address submitted via the CF7 form, meaning execution is deferred until an administrator interacts with the affected entry.
Explanation of Vulnerability in Simple Terms
02Summary
Connect Contact Form 7 and Mailchimp versions up to 0.9.78.06 contain a cross-site scripting vulnerability that allows attackers to inject malicious scripts into web pages viewed by site visitors. The vulnerability requires no authentication or user interaction beyond visiting an affected page. This can lead to theft of session cookies, credential harvesting, or malware distribution to your site's visitors.
What an attacker can do
03Attacker Capabilities
Inject malicious JavaScript that runs in visitors' browsers and steals their data or session tokens.
Potential impact on your site
04Site Impact
Visitor accounts and data compromised; site reputation damage; potential legal liability for data theft.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
July 9, 2026
CVE published
July 9, 2026
Record updated
