Read the docs

acyba

Records12All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high10CVSS 7.0–8.9

Exploited now

acyba records in CISA KEV

No acyba vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Acymailing 3 records MEDIUM Acymailing Starter 1 record MEDIUM Acysms 1 record MEDIUM

Records

12 records

TI-2024-06844 CVE-2024-7384 · GHSA-wv55-98hp-hrf7

AcyMailing <= 9.7.2 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Function

Priority MEDIUM 42

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the acym_extractArchive f…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00958 Published 2024-08-22 No fix listed CWE-434
TI-2026-54189 CVE-2026-77807 · GHSA-w97p-m43x-6fh6

Path traversal in acyba AcyMailing – An Ultimate Newsletter Plugin and Marketing…

Priority MEDIUM 41

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the `user[name]` P…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00928 Published 2026-09-10 No fix listed CWE-22
TI-2026-04543 CVE-2026-5200 · GHSA-54rj-qx28-9gcj

AcyMailing <= 10.8.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'acymailing_router'

Priority MEDIUM 40

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 10.8.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00336 Published 2026-05-20 No fix listed CWE-862
TI-2026-03118 CVE-2026-3614 · GHSA-3phr-p473-vc8q

AcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

Priority MEDIUM 40

The AcyMailing plugin for WordPress is vulnerable to privilege escalation in all versions From 9.11.0 up to, and including, 10.8.1 due to a missing capability check on the `wp_ajax_acymailing_router` AJAX handler.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00435 Published 2026-04-16 No fix listed CWE-862
TI-2026-71558 CVE-2026-102562 · GHSA-qqxc-3cx7-qv45

Stored cross-site scripting in AcyMailing WordPress plugin

Priority LOW 31

The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00247 Published 2026-10-13 No fix listed CWE-79
TI-2026-10472 CVE-2026-12170 · GHSA-8j9m-p63v-r54h

AcyMailing <= 10.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alignment' Attribute

Priority LOW 28

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alignment' attribute in all versions up to, and in…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00349 Published 2026-07-09 No fix listed CWE-79
Open these records in search →