CVE-2023-28733CWE-116CWE-20

Stored XSS affecting the AcyMailing plugin for Joomla

High · published March 30, 2023

CVSS v3.1
7.2
EPSS
0%
Percentile
29.7
In the wild
Unconfirmed
What it is

AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office.

This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00370 · 29.7th percentile
Weaknesses
CWE-116 · Improper Encoding or Escaping of Output; CWE-20 · Improper Input Validation
Published
2023-03-30T11:27Z
EPSS history
Timeline
  • 30 MAR 11:27Z
    Stored XSS affecting the AcyMailing plugin for Joomla
    cvelistv5