This vulnerability, identified as CWE-79, affects AcyMailing SMTP Newsletter versions up to and including 10.11.1. It is caused by improper neutralization of input during web page generation, specifically related to subscriber input, which can lead to cross-site scripting (XSS). The CVSS 3.1 vector indicates the attack requires network access, low attack complexity, privileges, and user interaction, with a scope change and impacts on confidentiality, integrity, and availability at a low to medium level.

An attacker with privileges and requiring user interaction can exploit this vulnerability to execute arbitrary scripts in the context of the affected application. This can lead to partial compromise of confidentiality, integrity, and availability of the system or user data. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented in the provided data. Users should monitor the vendor's communications for updates and apply any patches once available.