AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress — Vulnerabilities & Security Advisories 7

All 7 CVE vulnerabilities found in AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress, with AI-generated Chinese analysis, references, and POCs.

Vendor: acyba

CVE ID	Title	CVSS	Severity	Published
CVE-2026-102562	AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter CWE-79	7.2	High	2026-10-13
CVE-2026-77807	AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter CWE-22	7.5	High	2026-09-10
CVE-2026-15426	AcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update CWE-269	8.8	High	2026-08-11
CVE-2026-12170	AcyMailing <= 10.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alignment' Attribute CWE-79	6.4	Medium	2026-07-09
CVE-2026-5200	AcyMailing <= 10.8.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'acymailing_router' CWE-862	8.8	High	2026-05-20
CVE-2026-3614	AcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation CWE-862	8.8	High	2026-04-16
CVE-2024-7384	AcyMailing <= 9.7.2 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Function CWE-434	7.5	High	2024-08-22

All 7 known CVE vulnerabilities affecting AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress with full Chinese analysis, references, and POCs where available.