The SMTP for Amazon SES – YaySMTP plugin for WordPress contains a stored cross‑site scripting flaw that allows an attacker to inject JavaScript into email‑logging pages. The vulnerable code stores unsanitized input and later displays it without proper escaping, giving the attacker the ability to run arbitrary client‑side scripts whenever a user views the affected page. The flaw grants the attacker the same level of compromised user session as a typical XSS, with potential to steal cookies, perform phishing, or hijack user actions on the site.

WordPress sites that have the YaySMTP plugin version 1.7.1 or earlier installed are affected. The vulnerability is specific to the plugin’s email‑logging feature and does not impact WordPress core or other plugins.

The CVSS score of 7.2 indicates a high level of severity. The EPSS score of less than 1% suggests that exploitation is unlikely but still possible. The flaw is not yet listed in the CISA KEV catalog. Attackers would need to send crafted emails that are logged by the plugin and then trigger the log page for an authenticated user to suffer XSS. Because the vulnerability is unauthenticated, any user who can access the email‑log page could be targeted.