SecAlerts
a

acymailing

Security Risk Profile

63
/100
high

Security Risk Score

Comprehensive risk assessment based on 20 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from May 17, 2021 to present

20
Total CVEs
14
Critical+High
0
Exploited
8
Unpatched

Threat Assessment

Avg CVSS
7.4
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
8
Critical/High
Risk Level
63/100
high
🆕 2Fresh (<7d)📈 2 in Last 30 Days

Severity Distribution

Critical
4
High
10
Medium
6
Low
0

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
2

Age Distribution

Common Weaknesses (CWE)

1
XSS
6
2
SQL Injection
4
3
Malicious File Upload
3
4
Input Validation
3
5
Infoleak
2

Most Affected Products

1. AcyMailing Acymailing Joomla\!8
2. AcyMailing SMTP Newsletter3
3. AcyMailing Acymailing Wordpress3
4. AcyMailing AcyMailing Enterprise2
5. AcyMailing WordPress plugin2

Recent Vulnerabilities

See more →
CVE-2026-94131
CVSS 8.3high

Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0

Sep 26, 2026🔧 No Patch
CVE-2026-94132
CVSS 9.5critical

Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0

Sep 26, 2026🔧 No Patch
CVE-2026-15426
CVSS 8.8high

AcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update

Aug 11, 2026🔧 No Patch
CVE-2026-14920
CVSS 8.2high

AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter

Aug 2, 2026🔧 No Patch
CVE-2026-57741
CVSS 7.1high

WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - Cross Site Scripting (XSS) vulnerability

Jul 13, 2026🔧 No Patch
CVE-2026-57739
CVSS 9.3critical

WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - SQL Injection vulnerability

Jul 13, 2026🔧 No Patch
CVE-2026-57740
CVSS 7.1high

WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability

Jul 13, 2026🔧 No Patch
CVE-2026-56292
CVSS 9.2critical

Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1

Jul 9, 2026🔧 No Patch
CVE-2026-12170
CVSS 6.4medium

AcyMailing <= 10.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alignment' Attribute

Jul 9, 2026🔧 No Patch
CVE-2025-24617
CVSS 7.1EPSS 0%high

WordPress AcyMailing Plugin < 9.11.1 - Reflected Cross Site Scripting (XSS) vulnerability

Feb 14, 2025

Monitor acymailing in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.

acymailing Security Vulnerabilities & Risk Score | 20 CVEs | SecAlerts - SecAlerts