AcyMailing SMTP Newsletter CVE-2026-105318

Exploitation requires an attacker to trick a victim user into loading a crafted request to AcyMailing SMTP Newsletter (versions through 11.1.0), where unsanitized input is reflected into the generated web page (CWE-79). The specific vulnerable parameter or feature is not named in the description. The primary limiting factor is mandatory user interaction (UI:R) - the victim must follow the attacker's link; the payload is reflected (non-persistent), so it is not stored server-side, and impact is highest when the lured victim is an authenticated WordPress administrator. No attacker authentication is required (PR:N).

This is a moderate-severity reflected XSS (CVSS 7.1, CWE-79) in the AcyMailing SMTP Newsletter WordPress plugin, reported by Patchstack. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) describes network-reachable, low-complexity exploitation requiring no attacker privileges but mandatory user interaction (UI:R) - the victim must click or load an attacker-crafted link, which is the dominant limiting factor for reflected XSS. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so per the available signals the status is 'no public exploit identified at time of analysis.' There is no conflict between the CVSS vector and the description: both are consistent with remote, unauthenticated, interaction-dependent reflected XSS. Realistically this is a meaningful-but-not-emergency issue - reflected XSS typically enables targeted session or action compromise against a lured victim rather than mass automated exploitation, so it should be prioritized below unauthenticated RCE or KEV-listed bugs but patched in the normal cycle, especially where the victim could be a WordPress administrator. Note that all data derives from a single vendor source (Patchstack); no NVD enrichment, EPSS, or KEV corroboration is available to independently confirm severity or exploitation.

An attacker crafts a URL to a vulnerable AcyMailing SMTP Newsletter endpoint embedding a malicious script in a reflected, unsanitized parameter, then lures a logged-in site user or administrator into clicking it (e.g., via phishing email). When the victim's browser loads the response, the injected JavaScript executes in the WordPress origin, allowing session/cookie theft or actions performed as the victim. No public exploit code is referenced, so exploitation would require an attacker to independently identify the vulnerable parameter.