CVE-2025-0918 – The SMTP for SendGrid – YaySMTP WordPress plu... (How to Fix)

Q: What is the severity of CVE-2025-0918?

CVE-2025-0918 has a CVSS score of 7.2 (HIGH). The SMTP for SendGrid – YaySMTP WordPress plugin up to version 1.3.1 contains a stored cross-site scripting (XSS) vulnerability due to insufficient input sanitization. Unauthenticated attackers can inject malicious scripts that execute when users visit compromised pages. This affects all WordPress sites using vulnerable versions of this plugin.

📋 TL;DR

The SMTP for SendGrid – YaySMTP WordPress plugin up to version 1.3.1 contains a stored cross-site scripting (XSS) vulnerability due to insufficient input sanitization. Unauthenticated attackers can inject malicious scripts that execute when users visit compromised pages. This affects all WordPress sites using vulnerable versions of this plugin.

💻 Affected Systems

Products:

SMTP for SendGrid – YaySMTP WordPress plugin

Versions: Up to and including 1.3.1

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: All WordPress installations using vulnerable plugin versions are affected regardless of configuration.

📦 What is this software?

Yaysmtp by Yaycommerce

View all CVEs affecting Yaysmtp →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal administrator session cookies, redirect users to malicious sites, deface websites, or perform actions on behalf of authenticated users.

🟠

Likely Case

Attackers inject malicious scripts to steal user session cookies or redirect users to phishing sites, potentially compromising user accounts.

🟢

If Mitigated

With proper input validation and output escaping, the vulnerability would be prevented, maintaining normal plugin functionality.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Attackers can exploit this without authentication by injecting scripts through vulnerable input fields.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.3.2 or later

Vendor Advisory: https://wordpress.org/plugins/smtp-sendgrid/#developers

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'SMTP for SendGrid – YaySMTP'. 4. Click 'Update Now' if available. 5. Alternatively, download version 1.3.2+ from WordPress repository and replace plugin files.

🔧 Temporary Workarounds

Disable vulnerable plugin

WordPress

Temporarily disable the YaySMTP plugin until patched

wp plugin deactivate smtp-sendgrid

🧯 If You Can't Patch

Implement web application firewall (WAF) rules to block XSS payloads
Restrict plugin access to trusted IP addresses only

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins for YaySMTP version

Check Version:

wp plugin get smtp-sendgrid --field=version

Verify Fix Applied:

Verify plugin version is 1.3.2 or higher in WordPress admin panel

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to plugin endpoints with script tags
Multiple failed XSS attempts in web server logs

Network Indicators:

HTTP requests containing script injection patterns to plugin-specific URLs

SIEM Query:

source="web_server" AND (uri_path="/wp-content/plugins/smtp-sendgrid/" OR uri_path LIKE "%/smtp-sendgrid/%") AND (http_method="POST" OR http_method="GET") AND (request_body LIKE "%<script>%" OR request_body LIKE "%javascript:%")

📊 Metadata

CVE ID: CVE-2025-0918

CVSS v3 Score: 7.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

EPSS Score: 0.85% exploit probability (74.4th percentile)

Published: February 22, 2025

Last Updated: March 5, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-0918, you might also want to check these: