Stored Cross-Site Scripting in YaySMTP and Email Logs Plugin for WordPress
CVE-2025-0916
6.1MEDIUM
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 19 February 2025
What is CVE-2025-0916?
The YaySMTP and Email Logs plugin for WordPress is vulnerable to stored cross-site scripting (XSS) due to inadequate input sanitization and output escaping. This flaw allows unauthenticated attackers to inject malicious web scripts that can execute when users access affected pages. The vulnerability was initially addressed in version 2.4.8; however, it resurfaced in version 2.4.9 following the removal of the wp_kses_post() sanitization function. Users of versions 2.4.9 to 2.6.2 are at risk and are advised to upgrade to a patched version to protect against potential exploitation.
Affected Version(s)
YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service 2.4.9 <= 2.6.2