Cross-site Scripting Vulnerability in AcyMailing SMTP Newsletter by AcyMailing Team
CVE-2026-57741

7.1HIGH

Key Information:

Vendor

WordPress
Status
Acymailing Smtp Newsletter
Vendor
CVE Published:
13 July 2026

What is CVE-2026-57741?

The AcyMailing SMTP Newsletter plugin contains a Cross-site Scripting (XSS) vulnerability caused by improper input handling during web page generation. This flaw allows attackers to inject malicious scripts that could be executed in the context of a victim's browser, potentially leading to unauthorized actions, data theft, or website defacement. The issue affects the AcyMailing SMTP Newsletter plugin up to version 10.11.0, necessitating immediate review and remediation to secure affected installations.

Affected Version(s)

AcyMailing SMTP Newsletter 0 <= 10.11.0

References

https://patchstack.com/database/Wordpress/Plugin/acymaili...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

daroo | Patchstack Bug Bounty Program
.