Plugin icon

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress

acymailing

Vulnerabilities:

19

Last Updated:

October 6, 2026

Active Installs:

5000

Published
Title
Fixed in
CVSS
Published
2026-10-12
Title
AcyMailing < 11.1.1 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter
Fixed in
Fixed in 11.1.1
CVSS
7.2 (high)
Published
2026-10-07
Title
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress < 11.1.1 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 11.1.1
CVSS
7.2 (high)
Published
2026-10-01
Title
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress < 11.1.0 - Unauthenticated Arbitrary File Deletion
Fixed in
Fixed in 11.1.0
CVSS
9.1 (critical)
Published
2026-09-30
Title
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress < 11.1.0 - Unauthenticated Remote Code Execution
Fixed in
Fixed in 11.1.0
CVSS
9.8 (critical)
Published
2026-09-10
Title
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress < 11.0.5 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter
Fixed in
Fixed in 11.0.5
CVSS
7.5 (high)
Published
2026-08-13
Title
AcyMailing SMTP Newsletter < 11.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Fixed in
Fixed in 11.0.0
CVSS
6.4 (medium)
Published
2026-08-13
Title
AcyMailing SMTP Newsletter < 11.0.0 - Missing Authorization
Fixed in
Fixed in 11.0.0
CVSS
4.3 (medium)
Published
2026-08-11
Title
AcyMailing < 11.0.0 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update
Fixed in
Fixed in 11.0.0
CVSS
8.8 (high)
Published
2026-07-20
Title
AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter
Fixed in
Fixed in 10.11.1
CVSS
8.6 (high)
Published
2026-07-08
Title
AcyMailing < 10.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alignment' Attribute
Fixed in
Fixed in 10.11.0
CVSS
5.5 (medium)
Published
2026-07-06
Title
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress < 10.11.1 - Unauthenticated SQL Injection
Fixed in
Fixed in 10.11.1
CVSS
7.5 (high)
Published
2026-07-06
Title
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress < 10.11.1 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 10.11.1
CVSS
7.2 (high)
Published
2026-07-06
Title
AcyMailing < 11.0.0 - Missing Authorization
Fixed in
Fixed in 11.0.0
CVSS
4.3 (medium)
Published
2026-05-19
Title
AcyMailing < 10.9.0 - Subscriber+ Privilege Escalation via 'acymailing_router'
Fixed in
Fixed in 10.9.0
CVSS
8.8 (high)
Published
2026-04-15
Title
AcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Fixed in
Fixed in 10.8.2
CVSS
8.8 (high)
Published
2024-12-30
Title
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress < 9.11.1 - Reflected Cross-Site Scripting
Fixed in
Fixed in 9.11.1
CVSS
6.1 (medium)
Published
2024-08-21
Title
AcyMailing < 9.8.0 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Function
Fixed in
Fixed in 9.8.0
CVSS
7.5 (high)
Published
2023-09-25
Title
AcyMailing SMTP Newsletter < 8.6.3 - Reflected XSS
Fixed in
Fixed in 8.6.3
CVSS
7.1 (high)
Published
2021-04-29
Title
AcyMailing < 7.5.0 - Open Redirect
Fixed in
Fixed in 7.5.0
CVSS
4.3 (medium)