Unauthenticated Cross Site Scripting in AcyChecker by Patchstack
CVE-2026-65448

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Anti Spam And List Cleaner – Acychecker
Vendor
CVE Published:
27 July 2026

What is CVE-2026-65448?

AcyChecker versions up to 1.8.1 contain a severe vulnerability that allows unauthenticated users to execute malicious scripts within the context of a user's session. This Cross Site Scripting (XSS) flaw can be exploited to compromise user data and perform actions on behalf of the user, making immediate remediation essential for maintaining security.

Affected Version(s)

Anti Spam and list cleaner &#8211; AcyChecker <= 1.8.1

References

https://patchstack.com/database/wordpress/plugin/acycheck...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Trương Hữu Phúc (truonghuuphuc) | Patchstack Bug Bounty Program
.