YaySMTP < 2.2.2 – Admin+ Stored Cross-Site Scripting | CVE 2022-2372

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

Put the following payload in the From Email or From Name settings and save them: " autofocus onfocus=alert(/XSS/)//

Affects Plugins

yaysmtp

Fixed in 2.2.2

References

CVE

CVE-2022-2372

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

CVSS

3.4 (low)

Miscellaneous

Original Researcher

Rafshanzani Suhada

Submitter

Rafshanzani Suhada

Verified

Yes

WPVDB ID

941fadb6-0009-4751-b979-88e87ebb1e45

Timeline

Publicly Published

2022-07-18 (about 3 years ago)

Added

2022-07-18 (about 3 years ago)

Last Updated

2023-04-15 (about 2 years ago)

Other

Published

Title

Published

2024-04-15

Title

Elements Plus! < 2.16.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2019-11-17

Title

Sassy Social Share <= 3.3.3 - Cross-Site Scripting (XSS)

Published

2014-04-25

Title

Pay Per Media Player <= 1.24 - Multiple XSS

Published

2025-01-13

Title

Booking Calendar < 10.9.3 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode

Published

2023-10-09

Title

CITS Support svg, webp Media and TTF,OTF File Upload < 3.0 - Author+ Stored XSS via SVG