CVE-2022-2371 — YaySMTP < 2.2.1 - Subscriber+ Stored Cross-Site Scripting
The YaySMTP WordPress plugin before 2.2.1 does not have proper authorisation when saving its settings, allowing users with a role as low as subscriber to change them, and use th…
Published: 2022-08-08 · CVSS: Unscored
The YaySMTP WordPress plugin before 2.2.1 does not have proper authorisation when saving its settings, allowing users with a role as low as subscriber to change them, and use that to conduct Stored Cross-Site Scripting attack due to the lack of escaping in them as well.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7