Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
YaycommerceYaysmtp

11 matches found

CVE
CVE•added 2025/02/22 1:15 p.m.•75 views

CVE-2025-0918

The SMTP for SendGrid – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that wi...

7.2CVSS6.3AI score0.002EPSS
CVE
CVE•added 2022/08/01 1:15 p.m.•55 views

CVE-2022-2369

The YaySMTP WordPress plugin before 2.2.1 does not have capability check in an AJAX action, allowing any logged in users, such as subscriber to view the Logs of the plugin

4.3CVSS4.5AI score0.00107EPSS
CVE
CVE•added 2022/08/08 2:15 p.m.•55 views

CVE-2022-2371

The YaySMTP WordPress plugin before 2.2.1 does not have proper authorisation when saving its settings, allowing users with a role as low as subscriber to change them, and use that to conduct Stored Cross-Site Scripting attack due to the lack of escaping in them as well.

5.4CVSS5.3AI score0.00102EPSS
CVE
CVE•added 2025/02/22 1:15 p.m.•54 views

CVE-2025-0953

The SMTP for Sendinblue – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that ...

7.2CVSS6.3AI score0.002EPSS
CVE
CVE•added 2022/08/01 1:15 p.m.•48 views

CVE-2022-2370

The YaySMTP WordPress plugin before 2.2.1 does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any authenticated users, such as subscriber to retrieve them

6.5CVSS6.4AI score0.00218EPSS
CVE
CVE•added 2022/08/08 2:15 p.m.•45 views

CVE-2022-2372

The YaySMTP WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

4.8CVSS4.7AI score0.00083EPSS
CVE
CVE•added 2025/02/19 12:15 p.m.•41 views

CVE-2025-0916

The YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 2.4.9 to 2.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated ...

7.2CVSS6.3AI score0.002EPSS
CVE
CVE•added 2023/07/12 5:15 a.m.•33 views

CVE-2023-3093

The YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that wil...

7.2CVSS5.9AI score0.0071EPSS
CVE
CVE•added 2025/05/07 3:16 p.m.•33 views

CVE-2025-47587

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YaySMTP allows Blind SQL Injection. This issue affects YaySMTP: from n/a through 2.6.4.

7.6CVSS7.9AI score0.00041EPSS
CVE
CVE•added 2025/06/27 2:15 p.m.•6 views

CVE-2025-53256

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YaySMTP allows SQL Injection.This issue affects YaySMTP: from n/a through 2.6.5.

7.6CVSS7.2AI score0.00036EPSS
CVE
CVE•added last week•3 views

CVE-2025-48161

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YaySMTP allows SQL Injection. This issue affects YaySMTP: from n/a through 1.3.

7.6CVSS7.2AI score0.00036EPSS