CVE-2026-28182

Reflected XSS vulnerability in the AcyMailing SMTP Newsletter WordPress plugin. Improper input neutralization during page generation allows an attacker to inject malicious script.

The AcyMailing SMTP Newsletter plugin in versions up to and including 11.0.5 is vulnerable to unauthenticated remote code execution (RCE). An attacker can execute arbitrary code without authentication.

The AcyMailing SMTP Newsletter plugin for WordPress contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. The issue affects versions up to and including 10.11.0.

Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter <= 11.0.5 versions.

Broken Access Control vulnerability in AcyMailing SMTP Newsletter up to version 10.11.1 allows a subscriber to gain unauthorized access to administrative functions.

The AcyMailing SMTP Newsletter plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This issue affects all versions up to and including 10.11.0.

The AcyMailing SMTP Newsletter plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 10.11.1.