CVE-2023-28733 Stored XSS affecting the AcyMailing plugin for Joomla
Stored XSS in AcyMailing Joomla plugin allows attackers to inject scripts via templates or emails when campaign creation is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-28733?
CVE-2023-28733 is a high-severity cross-site scripting vulnerability in AcyMailing Newsletter Plugin for Joomla in the Enterprise version , published on 30 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office.
This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.
Which versions are affected by CVE-2023-28733?
It affects 1 product.
Products include Acymailing Acymailing.
How do I fix CVE-2023-28733?
No fix has been published for CVE-2023-28733 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-28733 being exploited?
There is no known exploitation of CVE-2023-28733 in the wild and no public exploit code.
Other vulnerabilities in AcyMailing Newsletter Plugin for Joomla in the Enterprise version
- CVE-2023-28731 Unauthenticated RCE affecting the AcyMailing plugin for Joomla
- CVE-2026-94132 File upload in AcyMailing Enterprise extension for Joomla
- CVE-2026-56292 Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1
- CVE-2026-94131 Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0
- CVE-2024-7384 AcyMailing <= 9.7.2 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Function
Sources
Also known as GHSA-3jpf-c526-5cw2.