The SMTP for SendGrid – YaySMTP plugin for WordPress, in versions up to and including 1.4, suffers from a stored cross‑site scripting flaw. Insufficient input sanitization and output escaping in the email logging component permit an unauthenticated attacker to insert arbitrary JavaScript into log entries. When a user opens a page that displays such a log entry, the injected script runs in the user’s browser, potentially altering the page’s appearance or behaviour as defined by the attacker.

Any WordPress site that has installed the yaycommerce SMTP for SendGrid – YaySMTP plugin version 1.4 or earlier is affected. The vulnerability is present in the email logging functionality of the plugin and does not depend on additional configuration beyond the presence of the plugin itself.

With a CVSS score of 7.2 the flaw is considered high severity, but the EPSS score of less than 1 % indicates that exploitation is currently unlikely. The vulnerability is not listed in CISA KEV. Attackers can exploit the flaw by sending log entries containing malicious scripts; the scripts are executed whenever a site user or administrator views the affected log page, providing the attacker a persistent client‑side vector.