CVE-2026-12170: AcyMailing WordPress Plugin Stored XSS Vulnerability (CVSS 6.4)

Technical summary

CVE-2026-12170 is a Stored XSS vulnerability (CWE-79) in the AcyMailing WordPress plugin stemming from insufficient input sanitization and output escaping of the 'alignment' attribute. The vulnerability requires authenticated access at contributor level or above and has a network attack vector with no user interaction required on the attacker's part (though the payload executes when victims visit the page). The CVSS v3.1 score of 6.4 (Medium) reflects the broad scope impact across the WordPress site context.

Business impact

Organizations using AcyMailing for email campaigns and marketing automation face injection of arbitrary content into their newsletter pages and campaign materials. Compromised pages could redirect users, capture credentials, deface brand messaging, or distribute malware to subscribers—damaging reputation and customer trust. The attack is particularly insidious because it leverages legitimate contributor accounts, making detection harder than external compromises.

Affected systems

AcyMailing plugin for WordPress, all versions up to and including 10.10.2. The vulnerability is triggered through the plugin's handling of the 'alignment' attribute, suggesting it may affect email template creation, newsletter design, or related form/content configuration interfaces where this attribute is processed.

Exploitability

Exploitation requires prior authentication as a WordPress contributor, editor, or administrator. No additional complexity or user interaction is needed beyond the initial malicious input submission. While the attack surface is limited to authenticated insiders or compromised contributor accounts, the persistence of the payload (stored XSS) makes it a high-value target for attackers seeking sustained access and broad victim reach.

Remediation

Update AcyMailing to a patched version released after 10.10.2. Verify the exact version number in the official plugin repository or vendor advisory. As an interim control, restrict contributor-level access to only trusted staff and monitor database changes for suspicious alignment attribute values. Consider using WordPress security plugins to detect stored XSS patterns in post metadata.

Patch guidance

Check the AcyMailing official repository and vendor security advisories for the version that addresses CVE-2026-12170. Update through the WordPress admin dashboard or manually via SFTP once a patched release is confirmed. Test the update in a staging environment first, especially if you have custom newsletter templates or integrations. Verify that existing email campaigns and templates render correctly post-patch.

Detection guidance

Monitor WordPress database logs and post revision history for unexpected changes to post meta fields containing 'alignment' attributes with script-like content (e.g., <script, onerror=, onclick=). Use WordPress security scanners to audit plugin versions. Review contributor and editor user activity logs for unusual content modifications. Inspect the raw HTML of published newsletters and campaign pages for unescaped JavaScript or event handlers.

Why prioritize this

Although this is a Medium-severity vulnerability, its stored nature, broad impact across WordPress site scope, and reliance on an internal threat actor (compromised or malicious contributor) make it a meaningful risk in multi-user WordPress environments. Organizations with many contributors or weak access controls should prioritize patching. Those with mature contributor vetting and activity monitoring may deprioritize slightly, but should not ignore it.

Risk score, explained

The CVSS 6.4 score reflects: network-accessible WordPress admin/frontend, low attack complexity (straightforward XSS injection), requirement for authenticated access (reduces risk vs. unauthenticated), low confidentiality/integrity impact per-user, but changed scope (XSS can affect site-wide resources and other users). Not exploited in the wild (KEV status: false) and not linked to ransomware, which moderates urgency but does not eliminate the security debt.

Frequently asked questions