# MailerLite – Signup forms (official) <= 1.7.26 - Authenticated (Editor+) Stored Cross-Site Scripting via Form Field Types, Group Names, and Embedded Form Name

- **ID:** WPSEC-2026-1818
- **Plugin:** MailerLite – Signup forms (official) (`official-mailerlite-sign-up-forms`), https://wordpress.org/plugins/official-mailerlite-sign-up-forms/
- **Affected versions:** all versions before 1.7.27
- **Fixed in:** 1.7.27 (Update to 1.7.27 or later.)
- **Severity:** Medium 5.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/official-mailerlite-sign-up-forms
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1818/

## Description

The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom form field type values, the selected group names and IDs, and the embedded form name in all versions up to, and including, 1.7.26, due to insufficient input sanitization and output escaping on the form edit page. This makes it possible for authenticated attackers whose role the site owner has granted access to the plugin's signup forms (Editor and above by default) to inject arbitrary web scripts that execute whenever an administrator or another user opens the form's edit page.

## References

- https://wpsec.com/vuln/WPSEC-2026-1818/
- https://plugins.svn.wordpress.org/official-mailerlite-sign-up-forms/tags/1.7.27/
- https://wordpress.org/plugins/official-mailerlite-sign-up-forms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1818/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.