PT-2025-50911 · Unknown+1 · Mailerlite+1

Nosleep · Published 2025-12-12 · Updated 2025-12-12 · CVE-2025-13993

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MailerLite – Signup forms (official) versions up to and including 1.7.16

Description The MailerLite – Signup forms (official) plugin for WordPress is susceptible to Stored Cross-Site Scripting through the form description and success message parameters. Insufficient input sanitization and output escaping allow authenticated attackers with administrator access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page.

Recommendations Versions prior to 1.7.16 should be updated.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-13993

Affected Products

Mailerlite

Mailerlite – Signup Forms

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-13993 · Security Note
• https://plugins.trac.wordpress.org/browser/official-mailerlite-sign-up-forms/tags/1.7.14/src/Controllers/AdminController.php#L224 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/8c37cc28-fde0-45c6-b49c-d6dfb296c4a5?source=cve · Note
• https://t.me/CVEtracker/39605 · Telegram Post
• https://plugins.trac.wordpress.org/browser/official-mailerlite-sign-up-forms/tags/1.7.14/src/Views/CustomForm.php#L94 · Note
• https://t.me/cveNotify/145575 · Telegram Post
• https://plugins.trac.wordpress.org/browser/official-mailerlite-sign-up-forms/tags/1.7.14/src/Controllers/AdminController.php#L179 · Note
• https://plugins.trac.wordpress.org/browser/official-mailerlite-sign-up-forms/tags/1.7.14/src/Views/CustomForm.php#L38 · Note
• https://plugins.trac.wordpress.org/changeset/3416100/official-mailerlite-sign-up-forms/trunk/src/Controllers/AdminController.php · Note