Easy Forms for Mailchimp < 6.8.9 – Reflected XSS | CVE 2023-2518 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape a parameter before outputting it back in the page when the debug option is enabled, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Proof of Concept

When the debug settings is enabled (ie /wp-admin/admin.php?page=yikes-inc-easy-mailchimp-settings&section=debug-settings), make a logged in admin open the URL below

https://example.com/wp-admin/admin.php?page=yikes-mailchimp-edit-form&sql_error=<svg/onload=alert(/XSS/)>

Affects Plugins

yikes-inc-easy-mailchimp-extender

Fixed in 6.8.9

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Erwan LR (WPScan)

Verified

Yes

WPVDB ID

ca120255-2c50-4906-97f3-ea660486db4c

Timeline

Publicly Published

2023-05-22 (about 2 years ago)

Added

2023-05-22 (about 2 years ago)

Last Updated

2023-06-13 (about 2 years ago)

Other

Published

Title

Published

2025-11-20

Title

Islamic Phrases <= 2.12.2015 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-02-14

Title

BEAR < 1.1.4.5 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2025-01-16

Title

Notifications Center <= 1.5.2 - Reflected Cross-Site Scripting

Published

2023-05-12

Title

Download Manager < 3.2.71 - Contributor+ Stored Cross-Site Scripting

Published

2019-02-14

Title

Newspaper Theme < 9.5 - Cross-Site Scripting (XSS)