Skip to content
Sign in
Not rated

CVE-2022-2371 The YaySMTP WordPress plugin before 2.2.1 does not have proper authorisation when saving its settings, allowing users…

Description

The YaySMTP WordPress plugin before 2.2.1 does not have proper authorisation when saving its settings, allowing users with a role as low as subscriber to change them, and use that to conduct Stored Cross-Site Scripting attack due to the lack of escaping in them as well.

Affected products and versions

Product Affected versions Fixed in
YaySMTP – Simple WP SMTP Mail 2.2 earliest → < 2.2.1 2.2.1

Other CVEs of YaySMTP – Simple WP SMTP Mail

The 3 CVEs of YaySMTP – Simple WP SMTP Mail →
CVE-2022-2372 The YaySMTP WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high… Not rated CVE-2022-2369 The YaySMTP WordPress plugin before 2.2.1 does not have capability check in an AJAX action, allowing any logged in… Not rated
Track this CVE