CVE-2026-102562 in AcyMailing Plugin
Summary
by MITRE • 10/13/2026
The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acym_cleanVar() sanitizer, whose HTML-tag stripper only matches complete tags (requiring a closing '>'), together with SubscriberInsertion::replaceUserInformation() and the archive view template, which substitute the stored subscriber field value into the mail body and emit it without HTML encoding. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the online-archive URL for the poisoned subscriber, including administrators who click the plugin-generated link in the Subscribers → History screen.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The AcyMailing plugin for WordPress contains a critical security vulnerability affecting versions up to and including 11.1.0 that allows unauthenticated attackers to execute stored cross-site scripting attacks. This flaw is rooted in insufficient input sanitization and output escaping mechanisms within the plugin's core processing logic. Specifically, the vulnerability resides in the customField[] parameter of the public frontusers::subscribe endpoint, which serves as an entry point for malicious actors to inject arbitrary web scripts into the application's database without requiring authentication. The root cause lies in the acym_cleanVar() sanitizer function, which employs a flawed HTML-tag stripping mechanism that only matches complete tags by looking for a closing greater-than symbol. This logic fails to properly sanitize inputs where tag boundaries are manipulated or incomplete, allowing malicious script payloads to bypass the filtering process and persist within stored subscriber data fields.
The operational impact of this vulnerability is significant because it enables persistent code execution across multiple user sessions once an administrator interacts with compromised records. The injected scripts remain dormant in the database until they are rendered by specific application components that fail to apply adequate output encoding. In particular, the SubscriberInsertion::replaceUserInformation() function and the archive view template substitute stored subscriber field values directly into email bodies and web pages without performing necessary HTML entity encoding. Consequently, when a user accesses an online-archive URL associated with a poisoned subscriber record, or when an administrator views the Subscribers history screen to inspect plugin-generated links, the malicious script is executed in their browser context. This behavior effectively turns stored data into active attack vectors that target privileged users and regular visitors alike.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involving the failure to encode output before rendering it in an HTML context further illustrates the critical importance of defense-in-depth strategies that include both input validation and strict output encoding protocols. Furthermore, from a tactical standpoint, this attack vector corresponds to ATT&CK technique T1059, Command and Scripting Interpreter, specifically within the JavaScript subcategory, as well as T1189 Drive-by Client Side Script Injection. The ability of unauthenticated attackers to inject scripts that execute upon viewing specific administrative interfaces highlights severe weaknesses in access control assumptions regarding who can trigger the rendering of stored user data.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Administrators should immediately update AcyMailing to a version newer than 11.1.0 where these sanitization flaws have been corrected by the vendor. In addition to updating, organizations should implement Web Application Firewall rules that detect and block attempts to inject script tags or event handlers through form submission endpoints like frontusers::subscribe. It is also advisable to review server-side configurations to ensure that any custom fields accepting user input are strictly validated against a whitelist of allowed characters rather than relying solely on blacklist-based sanitization which can be bypassed as demonstrated by this vulnerability. Finally, developers must enforce strict output encoding for all dynamic content rendered in HTML contexts to prevent stored payloads from executing even if they manage to persist in the database through other potential future flaws.