CVE-2022-2372

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The YaySMTP WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	YaySMTP – Simple WP SMTP Mail	>= 2.2.2, < 2.2.2

References

https://wpscan.com/vulnerability/941fadb6-0009-4751-b979-88e87ebb1e45Exploit, Third Party Advisory
https://wpscan.com/vulnerability/941fadb6-0009-4751-b979-88e87ebb1e45Exploit, Third Party Advisory

Timeline

Published: Aug 8, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-237208.2PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties fi CVE-2022-237213.3PingID integration for Windows login prior to 2.9 does not handle duplicate usernames, which can lead to a username collision when two peopl CVE-2022-237226.5When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID o CVE-2022-237237.7An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authen CVE-2022-237248.1Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypasse CVE-2022-237255.5PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under s CVE-2022-237264.9PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amo CVE-2022-237277.8There is a privilege escalation vulnerability in some webOS TVs. Due to wrong setting environments, local attacker is able to perform specif CVE-2022-237286.1Attacker can reset the device with AT Command in the process of rebooting the device. The LG ID is LVE-SMP-210011.CVE-2022-237297.8When the device is in factory state, it can be access the shell without adb authentication process. The LG ID is LVE-SMP-210010.CVE-2022-23735.3The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users CVE-2022-237309.8The public API error causes for the attacker to be able to bypass API access control.