The SMTP for SendGrid – YaySMTP WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. This allows unauthenticated attackers to inject malicious scripts that execute in the context of users visiting the compromised pages. The issue affects versions up to and including 1.4. The vulnerability has a CVSS 3.1 base score of 7.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with no availability impact. No patch or official fix has been documented in the provided data.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary scripts in the context of users visiting affected pages, potentially compromising user sessions and data confidentiality and integrity. There is no impact on availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin version to mitigate risk. Monitor vendor channels for updates and apply patches promptly once released.