The SMTP for Amazon SES – YaySMTP WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. This vulnerability exists in all versions up to 1.8 and allows unauthenticated attackers to inject malicious scripts into the Email Logs interface. When a user views the injected page, the malicious script executes in their browser context, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with scope change. No patch or remediation information is currently available.

An attacker can inject and store malicious scripts in the Email Logs of the YaySMTP plugin, which execute in the context of users viewing those logs. This can lead to unauthorized disclosure of sensitive information or manipulation of user sessions. The vulnerability does not affect availability. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the Email Logs page to trusted administrators only and avoid viewing untrusted content in the plugin interface. Monitor the yaycommerce vendor advisories for updates and apply patches promptly once available.