The vulnerability in the YayMail – WooCommerce Email Customizer plugin allows an authenticated user with Shop Manager or higher permissions to inject malicious JavaScript via unsanitized template settings. Because the input is stored and later rendered in email templates, the attacker can place arbitrary scripts that will execute whenever users view an affected page or email. This stored XSS can lead to cookie theft, session hijacking, defacement, or other malicious actions, while affecting the confidentiality, integrity, and availability of the site's front‑end content.

All installations of the YayMail – WooCommerce Email Customizer plugin built by YayCommerce up to and including version 4.3.2 are affected. The flaw is active only on WordPress multisite environments or sites where the 'unfiltered_html' capability is disabled, so any multisite blog or standard site with this capability restriction is potentially impacted.

The CVSS score is 4.4, indicating moderate risk. The EPSS score is below 1%, suggesting active exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate and possess Shop Manager or higher role permissions, but once they do they can persistently store malicious scripts that will run in the browsers of any user viewing the affected pages. Because the exploit requires only injection of template content via the plugin’s admin interface, external tooling is unnecessary.