CVE-2026-28182

MediumCVSS 6.5

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Cross Site Scripting (XSS) vulnerability in AcyMailing SMTP Newsletter versions up to 10.11.1, exploitable by a user with Subscriber role.

An attacker can inject malicious script, potentially leading to data theft or session hijacking.

Update the AcyMailing SMTP Newsletter plugin to the latest patched version.

Original NVD description (English source)

Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions.