The AcyMailing plugin fails to neutralize user‑supplied input before rendering it in a web page, allowing an attacker to inject malicious JavaScript. This reflected XSS flaw can be triggered when a crafted URL is accessed, and the injected script runs in the victim's browser. The consequences of successful exploitation include session hijacking, theft of authentication credentials, malicious redirects, or defacement of the site.

WordPress sites that use the AcyMailing Newsletter Team "AcyMailing SMTP Newsletter" plugin with a version older than 9.11.1 are impacted. The issue affects all releases from the plugin's inception through the 9.10.x branch and any earlier builds referred to as "n/a" in the vendor documentation.

The vulnerability has a CVSS score of 7.1, indicating high potential impact. The EPSS score is below 1 % and the flaw is not listed in the CISA KEV catalog, suggesting limited current exploitation. Nevertheless, because the flaw is remotely exploitable via a crafted request, the attack vector likely involves a reflected request parameter. An attacker would create a malicious link, possibly embedded in email or social media, that a victim would click, causing the victim's browser to execute injected JavaScript.