What’s Vulnerable › Vulnerabilities

CVE-2023-28733: Stored XSS affecting the AcyMailing plugin for Joomla

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-03-30 · updated 2026-06-17
• Weakness: CWE-20

Description

AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.

Affected products

• acyba AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress: before 8.3.0 — fixed in 8.3.0

How to fix

Upgrade to a fixed version: acyba AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress 8.3.0. Check the vendor advisory for mitigations.

References

• https://www.acymailing.com/change-log/
• https://www.bugbounty.ch/advisories/CVE-2023-28733
• https://www.acymailing.com/change-log/
• https://www.bugbounty.ch/advisories/CVE-2023-28733

Get alerted when CVE-2023-28733 or the next vulnerability affects your stack