CVE-2026-28182 MEDIUM

CVE-2026-28182: WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Cross Site Scripting (XSS) vulnerability

Vendor Acymailing Newsletter Team
Product AcyMailing SMTP Newsletter
Weakness CWE-79 · XSS
Published August 13, 2026
Last update August 13, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions.

Explanation of Vulnerability in Simple Terms

02Summary

AcyMailing SMTP Newsletter versions up to 10.11.1 contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts. An attacker with low-level access can craft a malicious link or page that, when visited by another user, executes arbitrary JavaScript in their browser. The vulnerability affects the newsletter component and can impact site visitors across the application.

What an attacker can do

03Attacker Capabilities

Inject and execute malicious JavaScript in other users' browsers to steal session tokens, redirect users, or deface content.

Potential impact on your site

04Site Impact

Site visitors and administrators can be compromised through malicious scripts; user sessions and data may be stolen or manipulated.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege account on the site; victim must click a malicious link or visit a compromised page.

Key dates

06Disclosure timeline

August 13, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-66457 WordPress Events Manager plugin <= 7.4.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-27537 WordPress Popup by Supsystic plugin <= 1.11.2 - Cross Site Scripting (XSS) vulnerability CVE-2026-19794 WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting CVE-2026-66663 WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability CVE-2026-66700 WordPress Smart Online Order for Clover plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability