AcyMailing EUVD-2026-42521

Exploitation requires the attacker to possess a valid WordPress account at contributor level or above - this is the definitive gating condition and the primary limit on real-world exposure. The AcyMailing plugin must be active and the vulnerable form or Gutenberg block must be placed on an accessible page. No non-default plugin configuration or special server setting is required beyond plugin activation. Payload execution additionally depends on a victim user (any role, including unauthenticated visitors) loading the page containing the injected element - this implicit user-visit dependency is not reflected in the provided UI:N CVSS metric and represents a meaningful practical friction point. Sites with closed registration and audited contributor accounts face substantially lower risk; sites permitting open contributor sign-up are the highest-risk deployment pattern.

The provided CVSS 6.4 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a low-privilege network attack with scope change. The PR:L constraint - requiring at minimum a valid contributor-level WordPress account - is the primary risk-limiting factor in most production environments where open user registration is disabled or contributor accounts are tightly managed. The UI:N metric in the provided vector warrants scrutiny: while the attacker's injection action requires no additional user interaction, payload execution is inherently conditional on a victim visiting the affected page - a dependency more accurately captured as UI:R; this is a known inconsistency in how CVSS scores stored XSS. No EPSS score was supplied in the input data, preventing quantitative exploitation-probability comparison. No KEV listing and no known POC code exist at time of analysis, indicating no confirmed or widespread exploitation. Realistic prioritization should be low-to-medium for sites with closed registration and controlled contributor roles, and elevated for sites permitting open or lightly-vetted contributor sign-up.

An attacker registers or compromises a contributor-level WordPress account on the target site and edits or creates an AcyMailing newsletter form or Gutenberg block, injecting a crafted JavaScript payload into the 'alignment' attribute field (e.g., a value containing a script tag or event handler). The payload is stored in the database without sanitization via the vulnerable code paths in form.php or Gutenberg.php. When any site visitor - including unauthenticated users - subsequently loads a page rendering that form or block, the script executes in their browser context, enabling the attacker to exfiltrate session cookies to a remote endpoint and potentially escalate to full administrative site takeover via stolen admin session tokens.