MailerLite – Signup forms (official)

MailerLite – Signup forms (official) has 8 disclosed vulnerabilities in the WordSec catalog, reported between 2020 and 2026; all 8 are fixed as of September 2026. Their average CVSS score is 6.5, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2024 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (38%). Other recurring categories include Cross-Site Request Forgery (CSRF), Missing Authorization.

Every one of the 8 issues recorded for MailerLite – Signup forms (official) has a vendor fix available, so running the current release closes all known holes.

7 independent researchers contributed these findings, most of them (2) reported by Patchstack. MailerLite – Signup forms (official) is installed on roughly 100,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.

Strategic Overview

Avg CVSSMedium

6.5/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all MailerLite – Signup forms (official) vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8

MailerLite Signup Forms < 1.4.4 - Unauthenticated SQL Injection

Read the full analysis

Vulnerability Records

8 records


2026-01-28 00:00	MailerLite – Signup forms (official) <= 1.7.18 - Missing Authorization MailerLite <= 1.7.18	`CVE-2026-25420`	4.3 Medium	daroo	Yes
2025-12-11 21:04	MailerLite – Signup forms (official) <= 1.7.16 - Authenticated (Administrator+) Stored Cross-Site Scripting MailerLite <= 1.7.16	`CVE-2025-13993`	5.5 Medium	NosleeP++	Yes
2024-04-29 00:00	MailerLite – Signup forms (official) 1.5.0 - 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting MailerLite 1.5.0 – 1.7.6	`CVE-2024-1386`	6.4 Medium	Richard Telleng (stueotue)	Yes
2024-04-29 00:00	MailerLite – Signup forms (official) <= 1.7.6 - Missing Authorization MailerLite <= 1.7.6	`CVE-2024-2797`	5.3 Medium	Krzysztof Zając	Yes
2022-08-01 00:00	MailerLite – Signup forms (official) <= 1.5.7 - Cross-Site Request Forgery MailerLite <= 1.5.7	`CVE-2022-33201`	8.8 High	Muhammad Daffa	Yes
2022-05-18 00:00	MailerLite - Signup forms <= 1.5.3 - Reflected Cross-Site Scripting MailerLite <= 1.5.3	`CVE-2022-1604`	6.1 Medium	Utkarsh Agrawal	Yes
2020-05-22 00:00	MailerLite Signup Forms < 1.4.4 - Unauthenticated SQL Injection MailerLite < 1.4.4	`N/A`	9.8 Critical	Patchstack	Yes
2020-05-22 00:00	MailerLite – Signup forms <= 1.4.4 - Cross-Site Request Forgery MailerLite < 1.4.5	`N/A`	5.4 Medium	Patchstack	Yes

Showing 1–8 of 8 reports

Latestv1.7.26

MailerLite – Signup forms (official)

Author

MailerLite

3.0(40)

60/100

Last Updated

2026-06-26 (3mo ago)

Active Installs

100,000+

Downloads

2,490,723

Requires WP

3.0.1+

Requires PHP

7.2.5+

Tested up to

WP 6.8.8

Created

2014-08-03 (12y ago)

MailerLite – Signup forms (official) plugin The Official MailerLite signup forms plugin makes it easy to grow your newsletter subscriber list from your WordPress blog or website. The plugin automatically integrates your WordPress form with your MailerLite email marketing account. If you don’t have MailerLite account yet, you can signup for a FREE trial here. Once you activate the plugin, you’ll be able to select and add any of the pre-built webforms from your MailerLite account or create a new form from scratch. You can place the form in the sidebar using a widget or use a shortcode to put it wherever you want. Setup is fast and easy! You just need to enter your MailerLite account API code and you’re all set. Plugin features include: Easily-to-add webforms from MailerLite to your WordPress blog or website Option to create new webforms WordPress 5 new editor support Save subscribers automatically to your MailerLite account Place webforms using widget or shortcode Double opt-in signup Updated plugin layout Automate welcome emails from your MailerLite account Arbitrary section

View on WordPress.org