Stored Cross-Site Scripting in AcyMailing Plugin for WordPress
CVE-2026-12170

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Acymailing – An Ultimate Newsletter Plugin And Marketing Automation Solution For WordPress
Vendor
CVE Published:
9 July 2026

What is CVE-2026-12170?

The AcyMailing plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) attacks stemming from inadequate sanitization of the 'alignment' attribute. This vulnerability affects all versions up to and including 10.10.2, allowing authenticated users with at least contributor-level access to insert arbitrary scripts into web pages. When other users visit these compromised pages, the injected scripts are executed, potentially compromising site security and user data.

Affected Version(s)

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress 0 <= 10.10.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/acymailing/tag...
https://plugins.trac.wordpress.org/browser/acymailing/tag...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chloe Chamberland
PRISM
.