What is the CVSS score of CVE-2026-12170?

CVE-2026-12170 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

AcyMailing CVE-2026-12170

EUVD-2026-42521 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-09 Wordfence

GHSA-8j9m-p63v-r54h

WordPress XSS Acymailing An Ultimate Newsletter Plugin And Marketing Automation Solution For Wordpress Wordpress Plugin Acyba

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS payload executes only when a victim visits the page, warranting UI:R; contributor authentication required sets PR:L; scope change applies as victim browser is the impacted component.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 08:43 vuln.today

CVE Published

Jul 09, 2026 - 06:52 nvd

MEDIUM 6.4

DescriptionCVE.org

The AcyMailing - An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alignment' attribute in all versions up to, and including, 10.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the AcyMailing WordPress newsletter plugin (all versions up to and including 10.10.2) permits authenticated contributors to inject persistent arbitrary scripts via the unsanitized 'alignment' attribute across both the classic form builder and Gutenberg block editor code paths. Any user - including unauthenticated site visitors - who subsequently loads a page containing the injected element triggers script execution in their browser, enabling session hijacking, credential theft, or malicious redirects. No public exploit identified at time of analysis and no CISA KEV listing, though the CVSS scope change (S:C) correctly reflects the cross-user, cross-session impact characteristic of stored XSS.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause, manifesting in two distinct AcyMailing code paths confirmed via WordPress Plugin Trac source references: back/Core/wordpress/form.php at lines 292 and 322, and WpInit/Gutenberg.php at lines 124 and 202. The 'alignment' attribute - a layout control semantically expected to accept only values such as 'left', 'center', or 'right' - is passed into rendered HTML output without encoding or allowlist validation. The CPE string (cpe:2.3:a:acyba:acymailing_-_an_ultimate_newsletter_plugin_and_marketing_automation_solution_for_wordpress:*:*:*:*:*:*:*:*) identifies the vendor as Acyba. Because vulnerable code exists in both the Gutenberg block registration layer and the classic form handler, the injection surface spans both modern block-editor and legacy shortcode/form workflows, broadening the attack surface across WordPress deployment styles.

RemediationAI

A fix has been committed to the WordPress Plugin Trac repository (changeset 3597432, viewable at https://plugins.trac.wordpress.org/changeset?reponame=&old=3597432%40acymailing&new=3597432%40acymailing); however, the specific patched release version number is not confirmed in the available input data - administrators should update to the latest available version via the WordPress Plugin Directory and cross-reference the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/4fd76fbc-22df-4071-a2ae-9c9ac9cdbc57 to confirm a patched release is available before updating. As a compensating control prior to patching, restrict contributor-level role assignments and disable open user registration, which removes the attack prerequisite entirely; the trade-off is reduced content-creation capacity. Deploying a WAF rule to strip or encode HTML attribute injection patterns in AcyMailing form submissions is an additional layer, though it may inadvertently block legitimate alignment formatting and requires tuning.