The AcyMailing plugin for WordPress contains a stored cross‑site scripting vulnerability that originates from the customField[] parameter of the publicly accessible frontusers::subscribe endpoint. Because the plugin's input sanitizer does not properly strip or encode HTML, an attacker can embed malicious JavaScript into a subscriber field that is later inserted unencoded into the mail body and the archive view. When any user, including administrators, views the online‑archive page for that subscriber, the script runs in the visitor’s browser, enabling arbitrary script execution in the context of that page. This flaw corresponds to CWE‑79.

The affected product is AcyMailing, the Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress from acyba. Versions up to and including 11.1.0 are vulnerable. Any installation of these versions that keeps the public frontusers::subscribe endpoint active is susceptible, regardless of the underlying WordPress version.

The CVSS base score of 7.2 places this flaw in the high‑severity range. Attackers need only unauthenticated access to post data to the frontusers::subscribe endpoint; no authentication or elevated privileges are required. Once a malicious value is stored, it is rendered whenever a user loads the subscriber’s archive page, including privileged administrators who click the link generated in the Subscribers → History screen. The exploitation path is straightforward, and the flaw is not listed in CISA's KEV catalog, while an EPSS score is not available. The high impact to privileged users makes this vulnerability a significant threat to affected sites.