CVE-2026-102562: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in acyba AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress

CVE-2026-102562 describes a stored cross-site scripting vulnerability in the AcyMailing WordPress plugin up to version 11.1.0. The flaw is due to inadequate sanitization in the acym_cleanVar() function, which only strips complete HTML tags, combined with the SubscriberInsertion::replaceUserInformation() and the archive view template that output stored subscriber data without proper HTML encoding. This allows unauthenticated attackers to inject malicious scripts via the customField[] parameter in the frontusers::subscribe endpoint, which execute when the poisoned subscriber's online archive URL is accessed, potentially impacting administrators and other users.

The vulnerability allows unauthenticated attackers to perform stored XSS attacks, injecting arbitrary scripts that execute in the context of users viewing the online archive page of a compromised subscriber. This can lead to information disclosure or session hijacking for affected users, including administrators who access plugin-generated subscriber history links. The CVSS 3.1 score is 7.2 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid clicking on subscriber history links generated by the plugin and restrict access to the online archive URL. Monitor vendor channels for updates and apply patches promptly once released.