{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://wordpress.org/plugins","product":"MC4WP: Mailchimp for WordPress","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"4.15.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118166","cwes":["CWE-74"],"description":"The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its dynamic content tags from being processed as shortcodes when a form is embedded with its block, allowing unauthenticated visitors to execute arbitrary registered shortcodes with attacker-chosen attributes. This requires the site owner to have added a request-derived tag to the form content and to embed the form with the block rather than the classic shortcode.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/a8b2a564-25ae-4ed8-9c2c-989b104ba4c8/"}],"kev":null,"metrics":[{"score":4.8,"severity":"medium","source":"CNA: WPScan","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1793950255888,"publishedAt":1793950255888,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/a8b2a564-25ae-4ed8-9c2c-989b104ba4c8/"}],"remediation":[],"revision":"5090fd72fe936cf7473875dbd183d75d80daed12771b55b6991ff8a455fc20bc","sources":[{"modifiedAt":1793950255888,"name":"CNA: WPScan","retrievedAt":1793952517917,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118166"}],"ssvc":null,"status":"published","title":"MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Arbitrary Shortcode Execution via Dynamic Content Tag","updatedAt":1793952517917}