The YayMail – WooCommerce Email Customizer plugin for WordPress contains a stored XSS vulnerability (CWE-79) due to improper neutralization of input during web page generation. This allows authenticated users with elevated privileges (Shop Manager or above) to inject arbitrary scripts via plugin settings. The vulnerability affects all versions up to and including 4.3.2 and is limited to multi-site setups or installations with unfiltered_html disabled. Exploitation requires high privileges and no user interaction, with partial impact on confidentiality and integrity but no availability impact.

Successful exploitation allows an attacker with Shop Manager or higher privileges to inject persistent malicious scripts into pages generated by the plugin. These scripts execute in the context of users viewing the injected pages, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability is constrained to multi-site or restricted unfiltered_html environments and requires authenticated access with elevated permissions.

No official patch or fix is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit Shop Manager and higher permissions to trusted users only, and consider disabling or restricting use of the YayMail plugin in multi-site or unfiltered_html-disabled environments. Monitor vendor channels for updates and apply official patches once released.