CVE-2025-30613
No known patch is available for this vulnerability.
The affected plugin has been removed from the WordPress.org directory (reason: Security Issue), and no patched version is being distributed through the official directory. If you have the affected software installed, you should uninstall or replace it rather than wait for an update.
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in N-Media Nmedia MailChimp nmedia-mailchimp-widget allows Stored XSS.This issue affects Nmedia MailChimp: from n/a through <= 5.4.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Stored XSS in Nmedia MailChimp plugin (<=5.4) allows script injection; plugin removed from WordPress.org, no patch.
Vulnerability
Stored cross-site scripting (XSS) vulnerability in the Nmedia MailChimp plugin for WordPress (slug: nmedia-mailchimp-widget) through version 5.4. The plugin fails to properly neutralize user input during web page generation, allowing arbitrary HTML and JavaScript to be stored and executed. [1]
Exploitation
An attacker with subscriber-level access or higher can inject malicious scripts via input fields that are not sanitized. The injected script is stored and executed in the context of any user viewing the affected page, including administrators. No authentication is required for exploitation beyond the ability to submit the form. [1]
Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of other users, leading to session hijacking, defacement, or theft of sensitive information. The attacker can perform actions on behalf of the victim, including modifying WordPress settings or exfiltrating data. [1]
Mitigation
No patched version is available. The plugin has been removed from the WordPress.org plugin directory as of March 18, 2025, due to a security issue. Users are advised to uninstall the plugin immediately and replace it with an alternative subscription service. [1]
AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2- Range: <=5.4
- Range: <=5.4
Patches
0nmedia-mailchimp-widgetThis plugin has been removed from the WordPress.org directory on 2025-03-18 (reason: Security Issue). No patched version is being distributed through the official directory. Users who have it installed should uninstall it.
Source: api.wordpress.org · directory page
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.