Ibericode develops email marketing and WordPress plugin products spanning Mailchimp integrations, form builders, and analytics tools that sit in the WordPress ecosystem and email infrastructure. The vendor's vulnerabilities cluster around application-layer input handling and access control, with cross-site scripting, SQL injection, open redirects, and authorization gaps recurring across its product line—weaknesses characteristic of web-facing and form-processing software. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Ibericode over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-22850HIGH Koko Analytics is an open-source analytics plugin for WordPress. Versions prior to 2.1.3 are vulnerable to arbitrary SQL execution through unescaped analytics export/import and per | Jan 19, 2026 | 8.3 | 28 | NO | NO |
CVE-2023-32517MEDIUM URL Redirection to Untrusted Site ('Open Redirect') vulnerability in PluginOps MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder.This issue affects MailChimp Sub | Dec 29, 2023 | 6.1 | 20 | NO | NO |
CVE-2021-36833MEDIUM Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ibericode's MC4WP plugin <= 4.8.6 at WordPress. | May 20, 2022 | 4.8 | 19 | NO | NO |
CVE-2017-18577MEDIUM The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg. | Aug 22, 2019 | 6.1 | 19 | NO | NO |
CVE-2016-10871MEDIUM The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page. | Aug 13, 2019 | 6.1 | 19 | NO | NO |
CVE-2024-9210MEDIUM The MC4WP: Mailchimp Top Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all ver | Oct 2, 2024 | 6.1 | 18 | NO | NO |
CVE-2024-8662MEDIUM The Koko Analytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up t | Sep 24, 2024 | 6.1 | 18 | NO | NO |
CVE-2024-8850MEDIUM The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email' parameter when a placeholder such as {email} is used for the | Sep 19, 2024 | 6.1 | 18 | NO | NO |
CVE-2024-8680MEDIUM The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.9.16 due to insuffic | Sep 21, 2024 | 5.5 | 17 | NO | NO |
CVE-2024-9704MEDIUM The Social Sharing (by Danny) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dvk_social_sharing' shortcode in all versions up to, and including | Oct 12, 2024 | 5.4 | 16 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Ibericode.
Media articles that mention a CVE ID that affects a product developed by Ibericode — matched by CVE ID, not by vendor name.