Vulnerabilities / MailerLite – Signup forms (official) / WPSEC-2026-1818
MailerLite – Signup forms (official) <= 1.7.26 - Authenticated (Editor+) Stored Cross-Site Scripting via Form Field Types, Group Names, and Embedded Form Name
Medium 5.5
CWE-79Fixed in 1.7.27
- ID
- WPSEC-2026-1818
- Plugin
- MailerLite – Signup forms (official) (official-mailerlite-sign-up-forms)
- Affected
- all versions before 1.7.27
- Remediation
- Update to 1.7.27 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-28
- Attack surface
- MailerLite – Signup forms (official) on WPSec AttackSurface
- Fix released
- Published
Description
The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom form field type values, the selected group names and IDs, and the embedded form name in all versions up to, and including, 1.7.26, due to insufficient input sanitization and output escaping on the form edit page. This makes it possible for authenticated attackers whose role the site owner has granted access to the plugin's signup forms (Editor and above by default) to inject arbitrary web scripts that execute whenever an administrator or another user opens the form's edit page.
References
- https://wpsec.com/vuln/WPSEC-2026-1818/
- https://plugins.svn.wordpress.org/official-mailerlite-sign-up-forms/tags/1.7.27/
- https://wordpress.org/plugins/official-mailerlite-sign-up-forms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS