CVE-2026-105318: WordPress AcyMailing SMTP Newsletter plugin <= 11.1.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Datasolution AcyMailing SMTP Newsletter acymailing allows Reflected XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through 11.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress AcyMailing SMTP Newsletterto a version that resolves this vulnerability.Fixed in 11.1.1
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates that exploitation can be performed remotely without authentication and with low attack complexity, but it requires user interaction. An attacker would need to cause a victim to interact with a crafted request or page.
Are installations running version 11.1.0 affected?
Yes. The affected range includes AcyMailing SMTP Newsletter through version 11.1.0, so version 11.1.0 is affected.
What impact can successful exploitation have?
The reported impact includes low-level effects on confidentiality, integrity, and availability. Because the scope is changed, the impact may extend beyond the vulnerable plugin's security authority.