CVE-2026-75872: HTML Injection in MailerUp double opt-in verification email
Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.
Generated by VEDAS. Scores as of 2026-11-01 19:19 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.
What it is
HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner’s configured sending identity, via the first_name field of the subscription request, which is interpolated unescaped into the double opt-in verification email.
Description quoted from the CVE record (assigned by Secur0, published 2026-08-18).
Weakness: CWE-80 Improper neutralization of Script-Related HTML tags in a web page (basic XSS)
How it can be exploited
Exploitable over the network with low attack complexity with no special attack requirements needing no privileges and no user interaction. Impact: confidentiality none, integrity low, availability none. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CISA assessment (SSVC): CISA has no evidence of exploitation. Automatable: no. Technical impact: partial.
Public exploit evidence (Exploit Observer)
Also known as: EUVD-2026-60820, GHSA-gj4p-rxxg-6jhm
VEDAS cluster: VEDAS:DEATHLOK
Exploit Observer links 3 pieces of public exploit code or detection modules that name this CVE or one of its aliases.
Exploit code and modules (3)
Code that names this CVE. A repository can be a working exploit, a scanner, a fake or malware; read it before running anything.
- Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/suricata/2026/CVE-2026-75872.rules
- Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/suricata/2026/CVE-2026-75872.rules
- Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/suricata/2026/CVE-2026-75872.rules
Vulnerability databases and vendor advisories (3)
Catalogue entries, not exploit evidence.
- Vulnerability database or vendor advisory: https://euvd.enisa.europa.eu/enisa/EUVD-2026-60820
- Vulnerability database or vendor advisory: https://github.com/advisories/GHSA-gj4p-rxxg-6jhm
- Vulnerability database or vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-75872
2 more references returned by Exploit Observer did not name this CVE or an alias, so they are left out.
VEDAS data as of 2026-11-01T17:12 UTC; fetched 2026-11-02.
Live scores
- EPSS
- 0.007
low predicted chance of attack - VEDAS
- 0.989
strong exploit evidence - On CISA KEV
- Not listed
- Detection rule
- Suricata
Who is affected
| Product | Affected | Not affected |
|---|---|---|
| maalfer MailerUp | before 1.1.3 | Not stated |
Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.
How to fix it
Fixed versions stated in the CVE record: 1.1.3.
Vendor guidance:
- https://github.com/maalfer/mailerup/commit/da4aedc9621911df4ce0cc8f0b321dd6d10f40a5 (patch)
- https://github.com/maalfer/mailerup/releases/tag/v1.1.3 (release-notes)
How to detect it
Suricata rules (network detection)
1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-75872 MailerUp - HTML Injection via subscription first_name. Add them to your Suricata rule set and reload.
Show the rules
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-75872 MailerUp - HTML Injection via subscription first_name"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/subscribe/"; nocase; fast_pattern; http.request_body; content:"first_name"; nocase; pcre:"/first_name[\x22'=:\s]{0,6}[^&,}\r\n]{0,120}(%3c|<)\s*\/?[a-z!]/i"; classtype:web-application-attack; reference:cve,CVE-2026-75872; reference:url,https://www.exploit.observer/?keyword=CVE-2026-75872&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=mailerup&match=exact; metadata:signature_type network_only; sid:1079207; rev:1;)
CVE-2026-75872.rules on GitHub
References
Vendor advisories and patches
- https://github.com/maalfer/mailerup/commit/da4aedc9621911df4ce0cc8f0b321dd6d10f40a5 (patch)
- https://github.com/maalfer/mailerup/releases/tag/v1.1.3 (release-notes)
Exploits and technical analysis
- https://secur0.com/en/cna/cve-list/cve-2026-75872-html-injection-in-mailerup-double-optin-verification-email (technical-description)
Other databases
Where this comes from
This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.