WordPress Plugin Vulnerabilities

YaySMTP < 2.4.6 - Unauthenticated Stored Cross-Site Scripting

Description

The plugin does not sufficiently sanitize and escape input from email contents, leading to the possibility of arbitrary web scripts injection in pages.

Affects Plugins

Plugin icon
yaysmtp
Fixed in 2.4.6

References

CVE
CVE-2023-3093
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/68e6ec3a-c5fd-4f63-a9a0-2c9ddfb96e2e

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Alex Thomas
Verified
No
WPVDB ID
91190a8c-e2e7-4929-bb55-3447878375fd

Timeline

Publicly Published
2023-06-12 (about 2 years ago)
Added
2023-07-12 (about 2 years ago)
Last Updated
2023-07-12 (about 2 years ago)

Other

Published
Title
Published
2025-03-04
Title
Stylish Google Sheet Reader < 4.1 - Reflected XSS
Published
2019-05-20
Title
FV Flowplayer Video Player < 7.3.14.727 - Unauthenticated Stored XSS
Published
2025-01-14
Title
Better WishList API < 1.1.4 - Unauthenticated Stored Cross-Site Scripting
Published
2016-07-20
Title
Lazy Load <= 0.6 - Cross-Site Scripting (XSS)
Published
2023-01-17
Title
Widgets on Pages < 1.8.0 - Contributor+ Stored XSS