Acyba vulnerabilities
12 vulnerabilities
Known vulnerabilities in Acyba products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 4 products.
Products
4- Acymailing – An Ultimate Newsletter Plugin And Marketing Automation Solution For Wordpress7 vulnerabilities
- Acymailing3 vulnerabilities
- Acymailing Starter1 vulnerabilities
- Acysms1 vulnerabilities
HighCVE-2026-102562acyba · acymailing – an ultimate newsletter plugin and marketing automation solution for wordpress +1 moreAcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' ParameterThe AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acym_cleanVar() sanitizer, whose HTML-tag stripper only matches complete tags (requiring a closing '>'), together with SubscriberInsertion::replaceUserInformation() and the archive view template, which substitute the stored subscriber field value into the mail body and emit it without HTML encoding. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the online-archive URL for the poisoned subscriber, including administrators who click the plugin-generated link in the Subscribers → History screen.EPSS0.25%HighCVE-2018-9106acyba · acysmsacyba acysmsCSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcySMS extension before 3.5.1 for Joomla! via a value that is mishandled in a CSV export.EPSS6.44%HighCVE-2018-9107acyba · acymailingacyba acymailingCSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcyMailing extension before 5.9.6 for Joomla! via a value that is mishandled in a CSV export.EPSS7.03%HighCVE-2015-7338acyba · acymailingacyba acymailingSQL Injection exists in AcyMailing Joomla Component before 4.9.5 via exportgeolocorder in a geolocation_longitude request to index.php.EPSS0.98%HighCVE-2020-10934acyba · acymailingacyba acymailingAcyba AcyMailing before 6.9.2 mishandles file uploads by admins.EPSS1.30%HighCVE-2024-7384acyba · acymailing – an ultimate newsletter plugin and marketing automation solution for wordpress +2 moreAcyMailing <= 9.7.2 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive FunctionThe AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the acym_extractArchive function in all versions up to, and including, 9.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.EPSS0.96%HighCVE-2026-77807acyba · acymailing – an ultimate newsletter plugin and marketing automation solution for wordpress +1 moreAcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' ParameterThe AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the `user[name]` Parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires "Embed images" option in AcyMailing configuration being enabled.EPSS0.93%HighCVE-2026-5200acyba · acymailing – an ultimate newsletter plugin and marketing automation solution for wordpress +1 moreAcyMailing <= 10.8.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'acymailing_router'The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 10.8.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify privileged AcyMailing configuration, export subscriber secret keys, and chain these actions into administrator account takeover when a target administrator email address is known.EPSS0.44%HighCVE-2026-15426acyba · acymailing – an ultimate newsletter plugin and marketing automation solution for wordpress +1 moreAcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template UpdateThe AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the BCC field of the acy_notification_cms notification template, causing subsequent WordPress password-reset emails — including those targeting administrator accounts — to be silently copied to an attacker-controlled address, enabling account takeover via the captured reset link. Successful exploitation requires the site administrator to have enabled the "Send website emails with AcyMailing" option, which routes WordPress core notification emails through AcyMailing's templating system.EPSS0.66%MediumCVE-2026-12170acyba · acymailing – an ultimate newsletter plugin and marketing automation solution for wordpress +1 moreAcyMailing <= 10.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alignment' AttributeThe AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alignment' attribute in all versions up to, and including, 10.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.35%HighCVE-2026-3614acyba · acymailing – an ultimate newsletter plugin and marketing automation solution for wordpress +1 moreAcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege EscalationThe AcyMailing plugin for WordPress is vulnerable to privilege escalation in all versions From 9.11.0 up to, and including, 10.8.1 due to a missing capability check on the `wp_ajax_acymailing_router` AJAX handler. This makes it possible for authenticated attackers, with Subscriber-level access and above, to access admin-only controllers (including configuration management), enable the autologin feature, create a malicious newsletter subscriber with an injected `cms_id` pointing to any WordPress user, and then use the autologin URL to authenticate as that user, including administrators.EPSS0.58%CriticalCVE-2023-39970acyba · acymailing_starter +1 moreExtension - acymailing.com - RCE in AcyMailing component for Joomla 6.7.0-8.5.0Unrestricted Upload of File with Dangerous Type vulnerability in AcyMailing component for Joomla. It allows remote code execution.EPSS1.05%