Description

Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T14:16:59.957Z",
  "pubdate": "2026-08-13T14:16:59.957Z",
  "executiveSummary": "An input validation vulnerability classified as Cross-Site Scripting (XSS) has been identified in the AcyMailing SMTP Newsletter plugin, specifically affecting versions 10.11.1 and prior.\nThis vulnerability allows remote attackers to inject arbitrary web scripts or HTML payloads into the application context, which are subsequently executed within the browser of unsuspecting users, such as administrators or subscribers.\nThe primary impact of this security flaw includes session hijacking, credential theft, redirection to malicious infrastructure, and unauthorized manipulation of the affected website's DOM.\nThe risk implications are elevated due to the potential for administrative account compromise if a privileged user interacts with the malicious payload.\nThe attacker capabilities require the ability to craft and deliver a specially formatted payload targeting subscriber data handling within the plugin.\nExploitation prerequisites generally require interaction with the vulnerable component or social engineering techniques to induce a victim into triggering the stored or reflected script execution path.",
  "technicalDetails": "The root cause of this vulnerability stems from insufficient sanitization and output encoding of user-supplied input handled by the AcyMailing SMTP Newsletter plugin.\nWhen processing subscriber-related data, the application fails to adequately neutralize special characters such as angle brackets, quotes, and JavaScript event handlers before rendering them in the web interface.\nThe vulnerable component resides within the subscriber management and data processing modules of the AcyMailing SMTP Newsletter plugin for versions <= 10.11.1.\nThe attack flow begins when an adversary submits crafted input containing malicious JavaScript or HTML tags into fields processed by the vulnerable plugin.\nIf the payload is stored within the database or reflected dynamically without proper contextual output encoding, it persists or executes immediately when the affected view is rendered by the web application.\nUpon rendering, the browser interprets the injected payload as legitimate executable code within the security context of the victim's session.\nAuthentication and privilege requirements depend on the specific vector, but exploitation often targets application interfaces accessible to subscribers or administrators.\nNetwork exposure is inherent to web applications utilizing the vulnerable plugin, making endpoints reachable over standard HTTP and HTTPS protocols susceptible to payload delivery.\nPost-exploitation impact ranges from local session compromise and unauthorized API requests executed via the victim's browser context to potential escalation of privileges if an administrative user views the injected content."
}