HTML Injection in the public subscription form of MailerUp allows unauthenticated remote attackers to send an email containing arbitrary HTML to a chosen address from the owner's configured sender identity via the first_name field, which is inserted unescaped into the double opt‑in verification email. This can be used to deliver malicious or phishing content and potentially compromise recipients’ browsers or email clients. The weakness is identified as CWE‑80.

MailerUp from maalfer version 1.1.2 and earlier, up to but not including 1.1.3, is affected. No other versions are known to be vulnerable.

The vulnerability has a CVSS score of 6.9, indicating moderate severity. EPSS data is unavailable, and the issue is not listed in CISA KEV. The likely attack vector is an unauthenticated network request to the public subscription form. An attacker can exploit the flaw by submitting a specially crafted first_name payload via the form to cause the application to send emails with supplied HTML content to any address.