What is the CVSS score of CVE-2026-57741?

CVE-2026-57741 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of AcyMailing are affected by CVE-2026-57741?

AcyMailing SMTP Newsletter plugin for WordPress (versions through 10.11.0) contains a stored cross-site scripting vulnerability allowing attackers to inject persistent malicious code that executes…

How to fix or mitigate CVE-2026-57741?

Within 24 hours: identify and document all WordPress installations running AcyMailing SMTP Newsletter plugin and their current versions; audit plugin configuration and user permissions with access to newsletter functionality. Within 7 days: disable the plugin entirely or migrate newsletter operations to an alternative solution; review server and application logs from the past 60 days for suspicious newsletter-related activities or script injections. Within 30 days: subscribe to vendor security advisories for patch availability; prepare testing and deployment procedures to move to a patched version immediately upon release.

AcyMailing CVE-2026-57741

EUVD-2026-43385 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Wordpress Plugin Acymailing Smtp Newsletter Acymailing Newsletter Team

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

Stored XSS realistically needs a low-privilege account to inject persistent content (PR:L) and a victim to view it (UI:R); scope change (S:C) as script escapes plugin context with limited C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:39 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Stored XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.0.

AnalysisAI

Stored cross-site scripting in the AcyMailing SMTP Newsletter plugin for WordPress allows attackers to persist malicious JavaScript that executes in the browser of any user who views the affected page, up to and including version 10.11.0. The scope-change CVSS vector (S:C) indicates the injected script can break out of the plugin's context into the wider WordPress site, enabling session theft or admin-panel actions. This flaw was reported by Patchstack and currently has no public exploit identified at time of analysis.

Technical ContextAI

AcyMailing is a popular newsletter and email-marketing plugin for WordPress; the SMTP Newsletter component handles composition, subscriber management, and delivery of campaigns. The vulnerability is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input is stored and later rendered into an HTML page without adequate output encoding or sanitization. Because the payload is persisted server-side (Stored XSS) rather than reflected, it fires automatically whenever the tainted content - such as a newsletter field, subscriber attribute, or campaign template - is rendered, and the CVSS scope change (S:C) signals the script executes outside the plugin's own security context, affecting the broader WordPress DOM.

RemediationAI

Upgrade the AcyMailing SMTP Newsletter plugin to the latest version beyond 10.11.0 as published on the WordPress plugin repository and confirmed via the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/acymailing/vulnerability/wordpress-acymailing-smtp-newsletter-plugin-10-10-2-cross-site-scripting-xss-vulnerability?_s_id=cve); the advisory slug references a 10.10.2 fix, but because the CVE states impact through 10.11.0, apply the newest available release rather than relying on 10.10.2, and no exact patched version is independently confirmed from the provided data. If immediate patching is not possible, apply a Web Application Firewall rule (Patchstack/Wordfence virtual patching) to filter XSS payloads on AcyMailing form and campaign endpoints, restrict who can create or edit newsletters and subscriber data to trusted administrators only, and enforce a restrictive Content-Security-Policy to blunt inline-script execution - noting that a strict CSP can break legitimate inline scripts used by other plugins and should be tested in staging.