Back to the CVE list

CVE-2026-102562

AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter

CVSS score

7.2

EPSS probability

%0.2

Risk score

0.0

Published

6 d ago

Overview Public Exploits (0)Newsroom Vulnerability Timeline

Related Security News

Articles and analysis bulletins in which the press and security publications have covered this vulnerability:

No verified news item has been matched to this CVE yet.

Similar Vulnerabilities

7.5

CVE-2026-77807AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter

Vendoracyba ProductAcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress

Patch status unknownEPSS %11 mo ago

8.8

CVE-2026-15426AcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update

Vendoracyba ProductAcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress

Patch status unknownEPSS %12 mo ago

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free key Documentation

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-102562"