CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.
Explanation of Vulnerability in Simple Terms
AcyMailing Enterprise for Joomla versions before 8.3.0 fail to properly validate user input, allowing an attacker to read sensitive data or modify site content without authentication. The vulnerability affects the newsletter plugin across all versions from 0 to 8.3.0. Site administrators should update immediately to version 8.3.0 or later.
What an attacker can do
Read sensitive data or modify site content without logging in.
Potential impact on your site
Unauthorized users can access private information and alter newsletter content or site data.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
