Stored Cross-Site Scripting in AcyMailing Plugin for WordPress
CVE-2026-102562
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 13 October 2026
What is CVE-2026-102562?
The AcyMailing plugin for WordPress contains a specific vulnerability that allows for stored cross-site scripting (XSS) via the customField[] parameter of the public frontusers::subscribe endpoint. This issue arises from inadequate input validation and lack of proper output encoding in the acym_cleanVar() function, which fails to effectively strip HTML tags. Consequently, this allows attackers to inject malicious scripts into the subscriber's data, which can execute whenever an unsuspecting user accesses the corresponding online-archive URL. This situation poses risks not only to regular users but also to site administrators who may engage with content generated by the affected plugin.
Affected Version(s)
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress 0 <= 11.1.0