Stored Cross-Site Scripting in YaySMTP and Email Logs Plugin for WordPress

CVE-2025-0916

What is CVE-2025-0916?

The YaySMTP and Email Logs plugin for WordPress is vulnerable to stored cross-site scripting (XSS) due to inadequate input sanitization and output escaping. This flaw allows unauthenticated attackers to inject malicious web scripts that can execute when users access affected pages. The vulnerability was initially addressed in version 2.4.8; however, it resurfaced in version 2.4.9 following the removal of the wp_kses_post() sanitization function. Users of versions 2.4.9 to 2.6.2 are at risk and are advised to upgrade to a patched version to protect against potential exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References