CVE-2026-75872 HTML Injection in MailerUp double opt-in verification email
Unauthenticated attackers can inject arbitrary HTML into verification emails via the first_name field, potentially executing scripts in recipients' browsers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-75872?
CVE-2026-75872 is a medium-severity cross-site scripting vulnerability in maalfer MailerUp, published on 18 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the first_name field of the subscription request, which is interpolated unescaped into the double opt-in verification email.
Weakness: CWE-80
Which versions are affected by CVE-2026-75872?
How do I fix CVE-2026-75872?
No fix has been published for CVE-2026-75872 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-75872 being exploited?
There is no known exploitation of CVE-2026-75872 in the wild and no public exploit code.
Sources
Also known as GHSA-gj4p-rxxg-6jhm.