The vulnerability occurs because the plugin does not properly sanitize or escape user-supplied email content that is then stored in the email logs. When an attacker injects malicious JavaScript into these logs, it will be executed in the browser of any user who views the logs page. This stored cross‑site scripting can lead to session hijacking, credential theft, or defacement of the site. The weakness is a classic CWE‑79 stored XSS flaw that allows arbitrary script execution on the client side.

Administrators of WordPress sites that use the SMTP for Amazon SES – YaySMTP plugin from the vendor yaycommerce are affected. All versions of the plugin up to and including 1.8 contain the vulnerability. Users who are logged into the WordPress admin area or who can view the email logs page are exposed to the risk.

The CVSS score of 7.2 indicates a high severity, but the EPSS score of less than 1% suggests that exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by submitting crafted email content that will be stored in the logs; any visitor, even unauthenticated, who views the logs page will trigger the malicious script. Because the attack is client‑side, it requires no additional privileges beyond access to the site, making it relatively easy to execute once the plugin is installed.