Medium severity · published Feb 19, 2025
CVE-2025-0916
YaySMTP 2.4.9 - 2.6.2 - Unauthenticated Stored Cross-Site Scripting
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
The YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 2.4.9 to 2.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: The vulnerability has been initially patched in version 2.4.8 and was reintroduced in version 2.4.9 with the removal of the wp_kses_post() built-in WordPress sanitization function.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YA
YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service · yaycommerce
2.4.9 through 2.6.2 · source: vendor
YA
Yaysmtp · Yaycommerce
2.4.9 before 2.6.3 · source: NVD
Affected product
YA
YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service
yaycommerce
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0916
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0916
Product
https://plugins.trac.wordpress.org/browser/yaysmtp/trunk/includes/Functions.php
Product
https://plugins.trac.wordpress.org/browser/yaysmtp/trunk/includes/Helper/Utils.php
Patch
https://plugins.trac.wordpress.org/changeset/3238172
Product
https://wordpress.org/plugins/yaysmtp/#developers
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/209019bd-b214-4389-a972-42e38d501203?source=cve
More from YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service
6.1
CVE-2023-3093
YaySMTP <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting via Email