This vulnerability (CVE-2026-75872) involves improper neutralization of script-related HTML tags (CWE-80) in maalfer MailerUp versions prior to 1.1.3. Specifically, the first_name field in the public subscription form is not sanitized, allowing an attacker to inject arbitrary HTML into the double opt-in verification email sent by the application. The injection is unauthenticated and remote, enabling the attacker to cause the application to send a message containing malicious HTML to an attacker-controlled email address, using the form owner's configured sending identity.

An attacker can exploit this vulnerability to send emails containing arbitrary HTML content from the legitimate sender's configured identity to an attacker-chosen address. This could potentially be used for phishing or social engineering attacks leveraging the trusted sender identity. However, the vulnerability does not require user interaction or privileges and has a medium severity score (CVSS 6.9). There is no indication of active exploitation in the wild.

No official patch or remediation level is currently confirmed. Users should upgrade to maalfer MailerUp version 1.1.3 or later once available, as the vulnerability affects versions before 1.1.3. Until a fix is confirmed, avoid exposing the vulnerable subscription form publicly or implement input validation and output encoding on the first_name field to prevent HTML injection.