AcyMailing (<= 11.1.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/acymailing--11.1.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 13 Oct 2026 08:34:05 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored Cross-Site Scripting in AcyMailing WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-10-acymailing-xss/Tue, 13 Oct 2026 08:34:05 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-acymailing-xss/An unauthenticated stored XSS vulnerability in AcyMailing WordPress plugin version 11.1.0 and earlier allows attackers to inject malicious scripts via the customField[] parameter.The AcyMailing plugin for WordPress, in versions up to and including 11.1.0, contains a critical security vulnerability involving Stored Cross-Site Scripting (XSS). The issue stems from insufficient input sanitization within the acym_cleanVar() function. Specifically, the plugin's HTML tag stripping mechanism is flawed, as it only successfully sanitizes complete tags that include a closing bracket. Furthermore, the SubscriberInsertion::replaceUserInformation() method and the archive view template fail to perform proper HTML encoding when substituting stored subscriber data into emails and archive pages. An unauthenticated attacker can exploit this by submitting malicious scripts through the customField[] parameter in the frontusers::subscribe endpoint. These scripts remain dormant until a victim, such as a site administrator, views the poisoned subscriber profile via the online-archive URL or the Subscribers history interface, at which point the script executes within the context of the victim's session.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the browser of an authenticated administrator or user. This can lead to session hijacking, unauthorized administrative actions within the WordPress dashboard, or the exfiltration of sensitive site data. The vulnerability affects all WordPress installations utilizing AcyMailing version 11.1.0 or lower.

Recommendation

  • Update the AcyMailing plugin to the latest version immediately to receive the patch for CVE-2026-102562.
  • Implement a Web Application Firewall (WAF) to filter incoming HTTP requests containing suspicious script tags or JavaScript event handlers in the customField[] parameter.
  • Audit the WordPress Subscribers history and archive pages for anomalous script tags if the site has been exposed to the internet while running vulnerable plugin versions.
]]>highadvisoryweb-applicationxsscmsvulnerability