EUVD-2026-57961
GHSA-fp7q-r7gq-9q6g
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Subscriber-level network XSS with scope change to admin session; availability impact omitted as XSS does not directly cause denial of service.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions.
AnalysisAI
Subscriber-level cross-site scripting in AcyMailing SMTP Newsletter plugin (versions up to and including 10.11.1) enables a low-privileged authenticated user to inject malicious script payloads that execute in the browser context of higher-privileged site users, such as administrators. The changed-scope CVSS vector (S:C, PR:L, UI:R) is consistent with stored XSS where subscriber-submitted content persists and fires when an administrator reviews it in the WordPress backend, enabling session hijacking or unauthorized administrative actions. No public exploit code and no active exploitation have been identified at time of analysis.
Technical ContextAI
AcyMailing SMTP Newsletter is a WordPress plugin used to manage subscriber lists and deliver email newsletters, identified by CPE cpe:2.3:a:acymailing_newsletter_team:acymailing_smtp_newsletter:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning subscriber-controlled input is rendered in an HTML context without adequate sanitization or output encoding. The CVSS privilege requirement of PR:L maps directly to the WordPress subscriber role - the lowest registered-user tier - indicating a subscriber-facing input field (likely a newsletter sign-up form field, profile field, or submission form within the plugin) does not strip or encode dangerous characters such as angle brackets and event handler attributes before persisting and later rendering the data to privileged users. The scope change (S:C) confirms the injected payload crosses a security boundary and executes in a session belonging to a different, more privileged principal.
RemediationAI
The primary remediation is to update AcyMailing SMTP Newsletter to the first release that addresses this vulnerability beyond version 10.11.1; the exact patched version number has not been independently confirmed from the available data, so administrators should consult the plugin's changelog on the WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/acymailing/vulnerability/wordpress-acymailing-smtp-newsletter-plugin-10-11-1-cross-site-scripting-xss-vulnerability for the confirmed fix release. As an interim compensating control, disabling open user registration on WordPress (Settings > General > Membership) removes the unauthenticated path to obtaining a subscriber account, which eliminates the primary exploitation vector at the cost of preventing new self-service registrations. Alternatively, deploying a WAF rule to strip or encode HTML special characters in plugin form submissions will reduce risk, though this may interfere with legitimate newsletter content containing HTML. Reviewing existing subscriber-submitted data for stored payloads is also advisable prior to applying a patch.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today