Stored Cross-Site Scripting Vulnerability in YaySMTP Plugin for WordPress
CVE-2025-3434
7.2HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 11 April 2025
What is CVE-2025-3434?
The YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) attacks due to inadequate input sanitization and output escaping in the Email Logs feature. This vulnerability allows unauthenticated attackers to inject arbitrary scripts into pages, compromising user interactions whenever affected pages are accessed. It is crucial for users of YaySMTP to ensure they update to the latest version to mitigate this risk.
Affected Version(s)
SMTP for Amazon SES – YaySMTP * <= 1.8