WordPress AcyMailing Plugin Stored XSS via Insufficient Sanitization

The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acym_cleanVar() sanitizer, whose HTML-tag stripper only matches complete tags (requiring a closing '>'), together with SubscriberInsertion::replaceUserInformation() and the archive view template, which substitute the stored subscriber field value into the mail body and emit it without HTML encoding. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the online-archive URL for the poisoned subscriber, including administrators who click the plugin-generated link in the Subscribers → History screen.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The AcyMailing plugin for WordPress versions up to 11.1.0 contains a Stored Cross-Site Scripting (CWE-79) vulnerability in its public subscription endpoint. Attackers can inject malicious scripts through the customField[] parameter that bypass the plugin's acym_cleanVar() sanitizer—specifically because the HTML tag stripper only matches complete tags with closing angle brackets, allowing incomplete or obfuscated payloads to persist in the database. Once stored, these scripts execute in the browsers of administrators and users viewing subscriber data or archive pages, leading to account compromise, credential theft, and lateral movement within WordPress installations. This affects any organization running AcyMailing up to version 11.1.0, particularly those using the plugin for email marketing and subscriber management without timely patching.

Casky's 323 mapped skills detect this attack pattern by correlating MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance) with input validation and output encoding analysis. Practitioners using Casky's Claude-powered detection would identify: (1) suspicious data flowing through the frontusers::subscribe endpoint with incomplete HTML tags or script fragments in customField parameters, flagging the sanitization bypass; (2) stored payload signatures in subscriber records that match XSS patterns; and (3) execution indicators when archive views or subscriber dashboards render unsanitized user input. The extended reasoning capability traces the full attack chain—from injection point through storage to execution context—allowing security teams to distinguish legitimate user input from malicious payloads and pinpoint where the sanitization chain fails before it reaches template rendering.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-102562.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-102562

Casky has 323 skills that investigate the attack patterns behind CVE-2026-102562. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn