CVE-2026-4561 is being labeled stored XSS, and that framing is technically accurate but strategically misleading. The actual vulnerability is a privilege boundary failure: the MailChimp for WordPress plugin exposes form response messages—strings like 'text_subscribed' and 'text_error'—at the Author capability level, allowing any user who can edit forms to inject JavaScript that executes when administrators access pages containing those forms.
What makes this significant is what the CVSS 6.4 obscures. The attacker already has legitimate write access to the exact data that becomes malicious. This isn't about bypassing an input filter; it's about the plugin treating security-sensitive configuration as content. Form response messages determine what JavaScript the browser runs after form submission. That's not user-generated content in any meaningful sense—it's configuration that happens to render as text.
The vulnerability exists because WordPress's data model conflates content and configuration at the storage layer. When plugins store UI strings in post meta, they inherit Author-level edit access by default through the normal WordPress UI. MC4WP isn't deviating from WordPress architecture—it's faithfully implementing what the platform makes easy while accidentally exposing something security-critical.
For defenders: audit which post meta fields your form plugins expose to sub-administrator roles. Look specifically for fields whose names contain 'text', 'message', or 'copy' and render without escaping. The fix isn't sanitization—it's removing Author access entirely from those meta fields, which means either a settings page gated to Administrator capability or UI redesign. A sanitization patch that leaves the privilege path open hasn't actually closed the vulnerability.
The broader pattern matters. Form builders, theme option frameworks, and plugin settings have been pulling this exact trick since at least 2013—storing execution-relevant strings in tables exposed to low-privilege roles, then getting individually patched when someone notices. Each CVE treats the instance as novel while the exploitation history proves it isn't. Until the WordPress plugin review process treats Author-accessible string fields that render without escaping as a canonical vulnerability class with a standard fix, this will keep reproducing.