These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acym_cleanVar() sanitizer, whose HTML-tag stripper only matches complete tags (requiring a closing '>'), together with SubscriberInser [truncated]
The AcyMailing plugin for WordPress, versions up to and including 11.0.4, is vulnerable to Directory Traversal. This vulnerability allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive information. The exploitation of this vulnerability requires the 'Embed images' option to be enabled in the AcyMailing configuration. Defenders should assess their exposure a [truncated]
The AcyMailing plugin for WordPress has a Missing Authorization vulnerability in versions up to 10.8.2. This allows authenticated attackers with subscriber-level access to modify AcyMailing configuration, export subscriber secret keys, and potentially take over administrator accounts. The vulnerability has a CVSS score of 8.8 and is classified as HIGH severity. Affected WordPress users should prioritize u [truncated]