CVE-2022-2371

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The YaySMTP WordPress plugin before 2.2.1 does not have proper authorisation when saving its settings, allowing users with a role as low as subscriber to change them, and use that to conduct Stored Cross-Site Scripting attack due to the lack of escaping in them as well.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	YaySMTP – Simple WP SMTP Mail	>= 2.2.1, < 2.2.1

References

https://wpscan.com/vulnerability/31405f1e-fc07-43f5-afc1-9cfbaf6911b7Exploit, Third Party Advisory
https://wpscan.com/vulnerability/31405f1e-fc07-43f5-afc1-9cfbaf6911b7Exploit, Third Party Advisory

Timeline

Published: Aug 8, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-237106.1A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which co CVE-2022-237115.3A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. Elastic Stack mo CVE-2022-237127.5A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an CVE-2022-237136.1A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be CVE-2022-237147.8A local privilege escalation (LPE) issue was discovered in the ransomware canaries features of Elastic Endpoint Security for Windows, which CVE-2022-237156.5A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and Elasticsearc CVE-2022-237165.3A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in d CVE-2022-237175.5PingID Windows Login prior to 2.8 is vulnerable to a denial of service condition on local machines when combined with using offline security CVE-2022-237188.1PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution. An attacker capable of achieving CVE-2022-237196.4PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An at CVE-2022-23724.8The YaySMTP WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2022-237208.2PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties fi