Now officially on WordPress.org

CVE Database / CVE-2025-13993

CVE · Medium

CVE-2025-13993 — MailerLite – Signup forms (official) [official-mailerlite-sign-up-forms] < 1.7.17

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2025-13993 MailerLite – Signup forms (official) [official-mailerlite-sign-up-forms] < 1.7.17 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 5.5 < 1.7.17 1.7.17 2025-12-11 —

CVE-2025-13993

The MailerLite Signup forms plugin for WordPress contains a security flaw in versions 1.7.16 and earlier, which allows malicious users with elevated privileges to introduce unauthorized code into the website's content through unsanitized input fields, specifically 'form_description' and 'success_message'. This vulnerability enables attackers to inject arbitrary scripts that will be executed when accessed by other users, compromising site integrity.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings