Plugin inspection:

MailChimp for WordPress

Potentially unsafe

Last revised:

Confidence: Medium
This plugin has been given a short, targeted code review.

Before using this plugin, you should very carefully consider its potential problems and should conduct a thorough assessment. Read more about this recommendation.

Warnings

This recommendation applies to version 3.1.5 of this plugin, but the most recent version is 4.9.19. These findings may no longer be correct.

Findings

  • Contains a reflected XSS vulnerability
  • Retrieves the content of https://mc4wp.com/api/content-blocks?id=106689 and echos it, meaning that whoever controls that domain name can inject arbitrary HTML into the page
  • Appears to trust the X-Forwarded-For header to get the user’s IP address (this is an incorrect assumption to make in many cases)

Reason for the 'Potentially unsafe' result

The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability:

Failure criteria

  • Lack of proper output escaping

Read more about our failure criteria.