EUVD-2026-118174

The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to time-based SQL Injection via the 'paramssearchKey' parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-109977

The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to time-based SQL Injection in versions up to and including 2.7.8 . The root cause is insufficient escaping of the user-supplied params[searchKey] parameter combined with a lack of sufficient prepara...