What is the CVSS score of EUVD-2026-98346?

EUVD-2026-98346 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate EUVD-2026-98346?

Because no vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, mitigation depends on urgent containment: within 24 hours, inventory all WordPress sites running AcyMailing 11.1.0 or earlier and either disable or remove the plugin, or block access to the frontusers::subscribe endpoint and online-archive URLs; deploy WAF rules to detect and block customField[] XSS payloads and review subscriber custom field records for suspicious content. Within 7 days, if the plugin must remain active, restrict access to the Subscribers → History screen and online-archive pages to trusted administrators, enforce least privilege, enable enhanced logging for admin sessions, and notify administrators about the risk of clicking plugin-generated links. Within 30 days, replace AcyMailing with an alternative newsletter/subscriber plugin if vendor remediation is not yet available, monitor the vendor advisory for a patched version and apply it immediately when released, and conduct a follow-up review of WordPress plugin inventory and update policies.

AcyMailing EUVD-2026-98346

| CVE-2026-102562 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-10-13 Wordfence

GHSA-qqxc-3cx7-qv45

WordPress XSS Acymailing An Ultimate Newsletter Plugin And Marketing Automation Solution For Wordpress Wordpress Plugin Acyba

7.2

CVSS 3.1 · Vendor: Wordfence

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Submit crafted customField via public subscribe endpoint
Delivery

Bypass acym_cleanVar incomplete tag stripper
Exploit

Store unescaped script in subscriber field
Execution

Admin opens online-archive URL
Impact

Script executes in admin browser session

Vulnerability Assessment

Weakness	CWE CWE-79 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Output encoding, context-aware escaping MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires the plugin's public subscription endpoint (frontusers::subscribe) to be reachable by anonymous users, which is the default for AcyMailing subscription forms. Exploitation is unauthenticated to inject (PR:N), but script execution is deferred and conditional: it only triggers when some user - most impactfully an administrator - accesses the online-archive URL for the attacker-controlled subscriber (e.g. clicks the generated link in Subscribers → History). This victim-access requirement, not any authentication, is the primary limiting factor; affected builds are version 11.1.0 and earlier.
Impact	This is a genuine but mid-tier priority, not a drop-everything issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 High) reflects a network-reachable, unauthenticated, low-complexity stored XSS whose scope change (S:C) captures execution in a victim's authenticated browser context - including administrators. However, the vector's UI:N is in tension with the description: the injected script only fires when a user, notably an admin, actually opens the online-archive URL for the poisoned subscriber (e.g. clicking the link in Subscribers → History), so there is a real victim-interaction/latency gate that tempers urgency despite UI:N. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input. KEV=NO and no public exploit identified means there is no evidence of active exploitation, and the stored-and-wait trigger makes opportunistic mass exploitation less likely than the raw 7.2 suggests. Net: patch in a normal cycle; the admin-session-takeover potential (script running with an administrator's privileges) is the main reason to prioritize it over a typical self-XSS.
Exploit ScenarioDerived	An unauthenticated attacker submits the public frontusers::subscribe form with a malicious payload in customField[] that evades the acym_cleanVar() tag stripper (which only removes complete tags ending in '>'), storing unescaped script in a subscriber field. The payload is later rendered without HTML encoding in the mail body / online-archive view, so when an administrator clicks the subscriber's archive link in Subscribers → History, the script executes in their authenticated session. No public exploit was identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 13, 2026

Stored cross-site scripting (XSS) in the AcyMailing WordPress plugin (versions up to and including 11.1.0) allows unauthenticated attackers to inject malicious scripts via the customField[] parameter of the public frontusers::subscribe endpoint. The injected script executes when a victim accesses the online-archive URL for the poisoned subscriber, potentially including administrators who click a plugin-generated link in the Subscribers → History screen. No public exploit code has been identified at time of analysis.

RemediationAI

Update to a patched version of AcyMailing once released. An upstream fix is available as a changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3729031%40acymailing&new=3729031%40acymailing, which should be applied or tracked for a stable release. As a workaround, disable the public subscription form (frontusers::subscribe endpoint) if not needed, or restrict access to the online-archive URLs (e.g., via web server rules) to authenticated users only; note that this may break newsletter archive functionality. Administrators should avoid clicking subscriber-generated links in the Subscribers → History screen without verifying the subscriber's trustworthiness. No vendor-released patch version has been confirmed.

Affected VersionsENISA

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress 0 ≤11.1.0

Affected Packages

euvd acymailing_an_ultimate_newsletter_plugin_and_marketing_automation_solution_for_wordpress no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability arises from a sanitization bypass in the AcyMailing plugin's acym_cleanVar() function, which attempts to strip HTML tags but only matches complete tags that include a closing '>'. Incomplete or malformed tags can bypass this filter, allowing raw HTML to be stored. The stored value is then substituted into the mail body by SubscriberInsertion::replaceUserInformation() and the archive view template without output encoding, leading to stored XSS (CWE-79). The affected component is the AcyMailing - An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress (CPE: cpe:2.3:a:acyba:acymailing_-_an_ultimate_newsletter_plugin_and_marketing_automation_solution_for_wordpress:*:*:*:*:*:*:*:*).

Know when Acymailing An Ultimate Newsletter Plugin And Marketing Automation Solution For Wordpress gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Wordfence) PRIMARY 7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI 7.2 HIGH

Unauthenticated network injection via a public endpoint (PR:N/AV:N/AC:L); scope change (S:C) and C:L/I:L reflect script executing in a different user's (admin) authenticated browser context with no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

DescriptionCVE.org

The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acym_cleanVar() sanitizer, whose HTML-tag stripper only matches complete tags (requiring a closing '>'), together with SubscriberInsertion::replaceUserInformation() and the archive view template, which substitute the stored subscriber field value into the mail body and emit it without HTML encoding. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the online-archive URL for the poisoned subscriber, including administrators who click the plugin-generated link in the Subscribers → History screen.

Articles & Coverage 1

News 6 New WordPress Vulnerabilities - 6 High Severity Oct 13, 2026

Executive ViewAI

Why It Matters

AcyMailing WordPress plugin versions up to and including 11.1.0 contain a stored cross-site scripting vulnerability that can allow malicious scripts to run in the browsers of site users, including administrators, when they view poisoned subscriber archives or history links. The flaw is remotely reachable through the plugin's public subscribe endpoint, and no vendor-released patch is currently identified, so affected organizations may face session hijacking, unauthorized administrative actions, or broader site compromise. Leadership should treat this as a priority for WordPress sites using AcyMailing because exploitation could undermine trust in newsletter operations and expose sensitive user data.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include disabling or removing AcyMailing 11.1.0 and earlier, blocking access to the frontusers::subscribe endpoint and online-archive URLs, deploying WAF rules to filter customField[] XSS payloads, restricting access to the Subscribers → History screen, and monitoring logs for suspicious subscriber custom field activity.

Threat Intelligence Overview

EPSS Score

0.2%

Top 85% exploitable

Prevalence

Medium

popular WordPress newsletter/marketing plugin, moderate but not universal install base

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.