CVE-2023-28733

6.1 mediumEPSS 0.4%

Medium (6.1) in acymailing acymailing. EPSS 0.4% chance of exploitation in the next 30 days.

AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
CWEs: CWE-79, CWE-20, CWE-116
Published: 2023-03-30
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

acymailing:acymailing

References

https://www.acymailing.com/change-log/
https://www.bugbounty.ch/advisories/CVE-2023-28733
https://www.acymailing.com/change-log/
https://www.bugbounty.ch/advisories/CVE-2023-28733

Check your stack JSON