AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress

Information

Software Type Plugin
Software Slug acymailing (view on wordpress.org)
Software Status Active
Software Author acyba
Software Downloads 231,958
Software Active Installs 6,000
Software Record Last Updated August 16, 2026

14 Vulnerabilities

Submit a Vulnerability
AcyMailing SMTP Newsletter <= 10.11.1 - Missing Authorization
4.3
CVE-2026-28181
Aug 13, 2026
Researcher: Asim Alshaya
AcyMailing SMTP Newsletter <= 10.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2026-28182
Aug 13, 2026
Researcher: Asim Alshaya
AcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update
8.8
CVE-2026-15426
Aug 11, 2026
Researcher: d.v4n_s3c
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress < 10.11.1 - Unauthenticated SQL Injection
7.5
CVE-2026-14920
Aug 6, 2026
Researcher: Pedro Pinho
AcyMailing <= 10.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alignment' Attribute
6.4
CVE-2026-12170
Jul 8, 2026
Researchers: Chloe Chamberland, Wordfence PRISM
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.0 - Unauthenticated SQL Injection
7.5
CVE-2026-57739
Jul 6, 2026
Researcher: kai63001
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.1 - Missing Authorization
4.3
CVE-2026-57740
Jul 6, 2026
Researcher: anhcd05
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-57741
Jul 6, 2026
Researcher: daroo
AcyMailing <= 10.8.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'acymailing_router'
8.8
CVE-2026-5200
May 19, 2026
Researcher: Azril Fathoni (kiseki)
AcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
8.8
CVE-2026-3614
Apr 15, 2026
Researcher: Ren Voza
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 9.11.0 - Reflected Cross-Site Scripting
6.1
CVE-2025-24617
Dec 30, 2024
Researcher: Dimas Maulana
AcyMailing <= 9.7.2 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Function
7.5
CVE-2024-7384
Aug 21, 2024
Researcher: Arkadiusz Hydzik
AcyMailing SMTP Newsletter <= 8.6.2 - Reflected Cross-Site Scripting
6.1
CVE-2023-41867
Sep 5, 2023
Researcher: Rafshanzani Suhada
AcyMailing SMTP Newsletter < 7.5.0 - Open Redirect
6.1
CVE-2021-24288
Apr 29, 2021
Researcher: Viktor Markopoulos
Title Status CVE ID CVSS Researchers Date
AcyMailing SMTP Newsletter <= 10.11.1 - Missing Authorization Patched CVE-2026-28181 4.3 Asim Alshaya August 13, 2026
AcyMailing SMTP Newsletter <= 10.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting Patched CVE-2026-28182 6.4 Asim Alshaya August 13, 2026
AcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update Patched CVE-2026-15426 8.8 d.v4n_s3c August 11, 2026
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress < 10.11.1 - Unauthenticated SQL Injection Patched CVE-2026-14920 7.5 Pedro Pinho August 6, 2026
AcyMailing <= 10.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alignment' Attribute Patched CVE-2026-12170 6.4 Chloe Chamberland, Wordfence PRISM July 8, 2026
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.0 - Unauthenticated SQL Injection Patched CVE-2026-57739 7.5 kai63001 July 6, 2026
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.1 - Missing Authorization Patched CVE-2026-57740 4.3 anhcd05 July 6, 2026
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.0 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-57741 7.2 daroo July 6, 2026
AcyMailing <= 10.8.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'acymailing_router' Patched CVE-2026-5200 8.8 Azril Fathoni (kiseki) May 19, 2026
AcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation Patched CVE-2026-3614 8.8 Ren Voza April 15, 2026
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 9.11.0 - Reflected Cross-Site Scripting Patched CVE-2025-24617 6.1 Dimas Maulana December 30, 2024
AcyMailing <= 9.7.2 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Function Patched CVE-2024-7384 7.5 Arkadiusz Hydzik August 21, 2024
AcyMailing SMTP Newsletter <= 8.6.2 - Reflected Cross-Site Scripting Patched CVE-2023-41867 6.1 Rafshanzani Suhada September 5, 2023
AcyMailing SMTP Newsletter < 7.5.0 - Open Redirect Patched CVE-2021-24288 6.1 Viktor Markopoulos April 29, 2021

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation