The CVSS 6.5 rating on this stored XSS in AcyMailing's subscriber management interface fundamentally misrepresents the actual risk. The vulnerability lives in the admin panel where you manage newsletter subscribers — names, custom fields, metadata — and the medium score treats this as a contained privilege escalation. It's not.
AcyMailing operates with elevated privileges specifically because it sends authenticated outbound email from your organization's domain. Compromising this admin panel doesn't give you a browser cookie — it gives you email infrastructure access. The attacker can send phishing from a domain that recipients have whitelisted, that passes every spam filter, that inherits all the trust your organization has built with its mailing list. That's not browser session theft; that's precision targeting infrastructure plus delivery in one package.
The deeper problem is why this vulnerability class keeps recurring in newsletter platforms. Subscriber management interfaces are among the oldest, least-refactored code paths in these applications — often unchanged since early versions. Development teams treat subscriber data as "internal context" that doesn't require the same output encoding rigor as user-facing surfaces. The admin panel becomes a forgotten zone: app security teams see it as "just a plugin," email security teams see it as "not their mail system." That jurisdictional vacuum is where the exposure compounds.
Push back on the medium severity. The EPSS score of 0.00211 measures automated scanner sweeps — this attack is never opportunistic, it's targeted. A phishing operator running a list of AcyMailing deployments finds this far more valuable than the probability metric suggests. Prioritize the patch not because of the XSS in isolation, but because it places your organization's trusted communication channel directly in the exploitation path. Check your AcyMailing version, apply the patch immediately, and review admin access logs for the subscriber management interface — the attackers targeting this are not running automated tools, they're looking for exactly this high-value foothold.