Skip to content
PluginCanary

MC4WP: Mailchimp for WordPress

by Danny van Kooten · 1,000,000+ active installs · Checked 3 Nov 2026
Healthy2 Warnings

Healthy: vulnerability published 18 Sep 2026, fixed in 4.14.1.

88/ 100 Canary Score
Sub-scores for MC4WP: Mailchimp for WordPress
Ownership100
Maintenance100
Security85
Support70
Reputation75

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 18 Sep 2026, fixed in 4.14.1. Update to version 4.14.1 or later.18 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 21 Aug 2026, fixed in 4.12.1. Update to version 4.12.1 or later.21 Aug 2026Evidence
  • InfoSEC-33 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence
  • InfoMOM-2Downloads in the last 4 weeks are down more than half vs the 26-week average. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
DvanKooten19 Jun 2013 to 3 Nov 2026, 612 commits

1 committer recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
yesterday
Releases, 24 months
27
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for MC4WP: Mailchimp for WordPress
Q1 20241
Q2 20242
Q3 20244
Q4 20243
Q1 20254
Q2 20253
Q3 20252
Q4 20252
Q1 20264
Q2 20267
Q3 20262
Q4 20261

Last release 3 Nov 2026. Tested with WordPress 7.1 (current).

Support

50% of 2 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
18 Sep 2026MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag6.1<= 4.14.04.14.10
21 Aug 2026MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages6.4<= 4.12.04.12.10
10 Mar 2026MC4WP: Mailchimp for WordPress <= 4.11.1 - Missing Authorization to Unauthenticated Arbitrary Subscription Deletion6.5<= 4.11.14.12.00
20 Sep 2024MailChimp for Wordpress <= 4.9.16 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4<= 4.9.164.9.170
18 Sep 2024MC4WP: Mailchimp for WordPress 4.9.9 - 4.9.16 - Reflected Cross-Site Scripting6.14.9.9 to 4.9.164.9.170
27 Dec 2023MC4WP <= 4.9.9 - Missing Authorization via listen5.3<= 4.9.94.9.100
2 Mar 2022MC4WP: Mailchimp for WordPress <= 4.8.6 - Authenticated (Admin+) Stored Cross-Site Scripting5.5<= 4.8.64.8.70
2 Mar 2022MC4WP: Mailchimp for WordPress < 4.8.7 - Cross-Site Scripting5.5< 4.8.74.8.70
1 Jun 2021MC4WP: Mailchimp for WordPress <= 4.8.4 - Cross-Site Request Forgery8.8<= 4.8.44.8.50
1 Jun 2021MC4WP: Mailchimp for WordPress <= 4.8.4 - Open Redirect6.1<= 4.8.44.8.50
9 Nov 2019MC4WP: Mailchimp for WordPress <= 4.1.6 - Reflected Cross-Site Scripting6.1<= 4.1.64.1.70
8 Sep 2017Mailchimp For WP <= 4.1.7 - Cross-Site Scripting6.1<= 4.1.74.1.80
13 Dec 2016MailChimp for WordPress <= 4.0.10 - Reflected Cross-Site Scripting6.1< 4.0.114.0.110

Source: Wordfence Intelligence.

Reputation

Average rating per quarter for MC4WP: Mailchimp for WordPress
Q1 20254.8
Q2 20255.0
Q3 20254.7
Q4 20254.7
Q1 20264.7
Q2 20264.6
Q3 20265.0
Q4 20264.0

Average rating fell from 4.8 to 4.0 between Q1 2025 and Q4 2026.

Rating distribution
5 star1377
4 star43
3 star19
2 star10
1 star49

Momentum

1,000,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for MC4WP: Mailchimp for WordPress
4 May 2026409,195
11 May 2026114,308
18 May 2026137,783
25 May 2026447,027
1 Jun 2026449,356
8 Jun 202684,316
15 Jun 202668,300
22 Jun 2026434,562
29 Jun 202688,454
6 Jul 2026125,300
13 Jul 202661,972
20 Jul 202658,550
27 Jul 202654,283
3 Aug 2026492,516
10 Aug 202683,522
17 Aug 202667,757
24 Aug 202669,394
31 Aug 202656,885
7 Sep 2026404,087
14 Sep 2026149,458
21 Sep 202699,143
28 Sep 202658,795
5 Oct 202651,807
12 Oct 202644,098
19 Oct 202653,988
26 Oct 202645,402
2 Nov 20266,245

Weekly downloads over the last 4 weeks are 76% below the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

SureContact - Newsletters, Email Marketing, Automation, Revenue Tracking & CRMScore 93 · 10,000+Hostinger Reach - AI-Powered Email Marketing for WordPressScore 91 · 1,000,000+MailPoet - Newsletters, Email Marketing, and AutomationScore 91 · 500,000+KlaviyoScore 91 · 100,000+Newsletters, Email Marketing, SMS and Popups by OmnisendScore 91 · 100,000+

Facts

Version4.15.0
AuthorDanny van Kooten
Added19 Jun 2013
Last updated3 Nov 2026
Active installs1,000,000+
Requires WordPress5.3
Tested up to7.1.4
Requires PHP7.4
CategoryE-commerce & Shopping
Tagsform, email, mailchimp, subscribe, newsletter

Other plugins by this author: Koko Analytics - Privacy-Friendly WordPress Analytics, Boxzilla - WordPress Popup Builder, Widget Content Blocks, MC4WP: Mailchimp Top Bar - Email Subscribe Notification Bar, Change Username, Social Sharing (by Danny), MC4WP: WPML Integration, Add Plain-Text Email

Questions

Is MC4WP: Mailchimp for WordPress still maintained?

MC4WP: Mailchimp for WordPress was last updated on 3 Nov 2026. Its Canary status is Healthy.

Is MC4WP: Mailchimp for WordPress safe?

MC4WP: Mailchimp for WordPress has no open unpatched vulnerabilities on record. 3 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns MC4WP: Mailchimp for WordPress?

The wordpress.org author is Danny van Kooten. Recent committers: DvanKooten, plugin-master. We have recorded no ownership change.

What can I use instead of MC4WP: Mailchimp for WordPress?

Plugins in the same category with a higher Canary Score: SureContact - Newsletters, Email Marketing, Automation, Revenue Tracking & CRM, Hostinger Reach - AI-Powered Email Marketing for WordPress, MailPoet - Newsletters, Email Marketing, and Automation, Klaviyo, Newsletters, Email Marketing, SMS and Popups by Omnisend.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue