YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports

Information

Software Type Plugin
Software Slug yaysmtp (view on wordpress.org)
Software Status Active
Software Author yaycommerce
Software Website yaycommerce.com
Software Downloads 261,828
Software Active Installs 10,000
Software Record Last Updated July 13, 2026

8 Vulnerabilities

Submit a Vulnerability
YaySMTP <= 2.6.6 - Authenticated (Administrator+) SQL Injection
4.9
CVE-2025-53256
Jun 27, 2025
Researcher: Nguyen Kim Sang
YaySMTP <= 2.6.4 - Authenticated (Administrator+) SQL Injection
4.9
CVE-2025-47587
May 7, 2025
Researcher: ChuongVN
YaySMTP 2.4.9 - 2.6.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2025-0916
Feb 18, 2025
Researcher: zer0gh0st
YaySMTP <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting via Email
7.2
CVE-2023-3093
Jun 12, 2023
Researcher: Alex Thomas
YaySMTP – Simple WP SMTP Mail <= 2.2 - Stored Cross-Site Scripting
6.4
CVE-2022-2371
Jul 18, 2022
Researcher: Rafshanzani Suhada
YaySMTP – Simple WP SMTP Mail <= 2.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
5.5
CVE-2022-2372
Jul 15, 2022
Researchers:
YaySMTP – Simple WP SMTP Mail <= 2.2 - Missing Authorization to Sensitive Information Exposure
6.5
CVE-2022-2370
Jul 11, 2022
Researchers:
YaySMTP – Simple WP SMTP Mail <= 2.2 - Sensitive Information Disclosure
7.5
CVE-2022-2369
Jul 11, 2022
Researcher: Rafshanzani Suhada
Title Status CVE ID CVSS Researchers Date
YaySMTP <= 2.6.6 - Authenticated (Administrator+) SQL Injection Patched CVE-2025-53256 4.9 Nguyen Kim Sang June 27, 2025
YaySMTP <= 2.6.4 - Authenticated (Administrator+) SQL Injection Patched CVE-2025-47587 4.9 ChuongVN May 7, 2025
YaySMTP 2.4.9 - 2.6.3 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2025-0916 7.2 zer0gh0st February 18, 2025
YaySMTP <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting via Email Patched CVE-2023-3093 7.2 Alex Thomas June 12, 2023
YaySMTP – Simple WP SMTP Mail <= 2.2 - Stored Cross-Site Scripting Patched CVE-2022-2371 6.4 Rafshanzani Suhada July 18, 2022
YaySMTP – Simple WP SMTP Mail <= 2.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2022-2372 5.5 July 15, 2022
YaySMTP – Simple WP SMTP Mail <= 2.2 - Missing Authorization to Sensitive Information Exposure Patched CVE-2022-2370 6.5 July 11, 2022
YaySMTP – Simple WP SMTP Mail <= 2.2 - Sensitive Information Disclosure Patched CVE-2022-2369 7.5 Rafshanzani Suhada July 11, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation