Acymailing Smtp Newsletter
Monthly
Stored cross-site scripting in the AcyMailing SMTP Newsletter plugin for WordPress allows attackers to persist malicious JavaScript that executes in the browser of any user who views the affected page, up to and including version 10.11.0. The scope-change CVSS vector (S:C) indicates the injected script can break out of the plugin's context into the wider WordPress site, enabling session theft or admin-panel actions. This flaw was reported by Patchstack and currently has no public exploit identified at time of analysis.
Blind SQL injection in the AcyMailing SMTP Newsletter plugin for WordPress (all versions up to and including 10.11.0) lets remote attackers inject arbitrary SQL through unsanitized input and extract database contents inference-by-inference. The CVSS 3.1 base score is 9.3, elevated by a changed scope and confidentiality impact against the underlying WordPress database. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; the finding originates from Patchstack.
Broken access control in the AcyMailing SMTP Newsletter plugin for WordPress (versions up to and including 10.11.1) lets an authenticated low-privileged user reach functionality that should be restricted, impacting integrity and, most notably, availability of the plugin's newsletter/mailing operations. The flaw is a missing authorization check (CWE-862) reported by Patchstack; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Note an inconsistency in the source data: the CVE description states affected 'through <= 10.11.1' while the linked Patchstack advisory slug references 10.10.2 - the exact patched version is not confirmed from the input.
Subscriber-level cross-site scripting in AcyMailing SMTP Newsletter plugin (versions up to and including 10.11.1) enables a low-privileged authenticated user to inject malicious script payloads that execute in the browser context of higher-privileged site users, such as administrators. The changed-scope CVSS vector (S:C, PR:L, UI:R) is consistent with stored XSS where subscriber-submitted content persists and fires when an administrator reviews it in the WordPress backend, enabling session hijacking or unauthorized administrative actions. No public exploit code and no active exploitation have been identified at time of analysis.
Broken access control in the AcyMailing SMTP Newsletter WordPress plugin (versions <= 10.11.1) permits subscriber-level users to access restricted functionality reserved for higher-privileged roles. The flaw, rooted in missing authorization checks (CWE-862), allows a low-privileged but authenticated WordPress user to read sensitive newsletter data - including subscriber lists, campaign details, or configuration - that should require administrator or editor access. No public exploit or active exploitation via CISA KEV is confirmed at time of analysis, though Patchstack has documented and disclosed the vulnerability.
Stored cross-site scripting in the AcyMailing SMTP Newsletter plugin for WordPress allows attackers to persist malicious JavaScript that executes in the browser of any user who views the affected page, up to and including version 10.11.0. The scope-change CVSS vector (S:C) indicates the injected script can break out of the plugin's context into the wider WordPress site, enabling session theft or admin-panel actions. This flaw was reported by Patchstack and currently has no public exploit identified at time of analysis.
Blind SQL injection in the AcyMailing SMTP Newsletter plugin for WordPress (all versions up to and including 10.11.0) lets remote attackers inject arbitrary SQL through unsanitized input and extract database contents inference-by-inference. The CVSS 3.1 base score is 9.3, elevated by a changed scope and confidentiality impact against the underlying WordPress database. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; the finding originates from Patchstack.
Broken access control in the AcyMailing SMTP Newsletter plugin for WordPress (versions up to and including 10.11.1) lets an authenticated low-privileged user reach functionality that should be restricted, impacting integrity and, most notably, availability of the plugin's newsletter/mailing operations. The flaw is a missing authorization check (CWE-862) reported by Patchstack; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Note an inconsistency in the source data: the CVE description states affected 'through <= 10.11.1' while the linked Patchstack advisory slug references 10.10.2 - the exact patched version is not confirmed from the input.
Subscriber-level cross-site scripting in AcyMailing SMTP Newsletter plugin (versions up to and including 10.11.1) enables a low-privileged authenticated user to inject malicious script payloads that execute in the browser context of higher-privileged site users, such as administrators. The changed-scope CVSS vector (S:C, PR:L, UI:R) is consistent with stored XSS where subscriber-submitted content persists and fires when an administrator reviews it in the WordPress backend, enabling session hijacking or unauthorized administrative actions. No public exploit code and no active exploitation have been identified at time of analysis.
Broken access control in the AcyMailing SMTP Newsletter WordPress plugin (versions <= 10.11.1) permits subscriber-level users to access restricted functionality reserved for higher-privileged roles. The flaw, rooted in missing authorization checks (CWE-862), allows a low-privileged but authenticated WordPress user to read sensitive newsletter data - including subscriber lists, campaign details, or configuration - that should require administrator or editor access. No public exploit or active exploitation via CISA KEV is confirmed at time of analysis, though Patchstack has documented and disclosed the vulnerability.