WP-Safety

SMTP for SendGrid – YaySMTP Security & Risk Analysis

wordpress.org/plugins/smtp-sendgrid

Send emails from WordPress through SendGrid using SMTP by YayCommerce

1K active installs v1.5.1 PHP 5.3+ WP 4.0+ Updated May 18, 2026
sendgridsendgrid-smtptransactional-emailwp-mail-smtpwp-mail
98
A · Safe
CVEs total2
Unpatched0
Last CVEJul 16, 2025
Plugin page Download
Safety Verdict

Is SMTP for SendGrid – YaySMTP Safe to Use in 2026?

Generally Safe

Score 98/100

SMTP for SendGrid – YaySMTP has a strong security track record. Known vulnerabilities have been patched promptly. It's a solid choice for most WordPress installations.

2 known CVEsLast CVE: Jul 16, 2025Updated 3mo ago
Risk Assessment

The 'smtp-sendgrid' plugin v1.5.1 exhibits a generally strong security posture based on the provided static analysis. The absence of identified AJAX handlers, REST API routes, shortcodes, and cron events with unprotected entry points suggests a limited attack surface. Furthermore, the code demonstrates good practices with a high percentage of SQL queries using prepared statements and a majority of outputs being properly escaped. The presence of nonce and capability checks, along with a single external HTTP request, are also positive indicators.

Key Concerns

  • High historical high/medium CVE count
  • Bundled PHPMailer library
  • Some SQL queries not prepared
  • Some outputs not escaped
Vulnerabilities
2 published

SMTP for SendGrid – YaySMTP Security Vulnerabilities

CVEs by Year

2 CVEs in 2025
2025
Patched Has unpatched

Severity Breakdown

High
1
Medium
1

2 total CVEs

CVE-2025-48301medium · 4.9Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

SMTP for SendGrid – YaySMTP <= 1.5 - Authenticated (Administrator+) SQL Injection

Jul 16, 2025 Patched in 1.5.1 (7d)
CVE-2025-0918high · 7.2Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

SMTP for SendGrid – YaySMTP <= 1.4 - Unauthenticated Stored Cross-Site Scripting via Email Logs

Feb 22, 2025 Patched in 1.5 (48d)
Version History

SMTP for SendGrid – YaySMTP Release Timeline

v1.5.1Current
v1.51 CVE
CVE-2025-48301
v1.42 CVEs
CVE-2025-48301 CVE-2025-0918
v1.3.12 CVEs
CVE-2025-48301 CVE-2025-0918
v1.32 CVEs
CVE-2025-48301 CVE-2025-0918
Code Analysis
Analyzed Mar 16, 2026

SMTP for SendGrid – YaySMTP Code Analysis

Dangerous Functions
0
Raw SQL Queries
4
11 prepared
Unescaped Output
5
36 escaped
Nonce Checks
1
Capability Checks
2
File Operations
8
External Requests
1
Bundled Libraries
1

Bundled Libraries

PHPMailer

SQL Query Safety

73% prepared15 total queries

Output Escaping

88% escaped41 total outputs
Attack Surface

SMTP for SendGrid – YaySMTP Attack Surface

Entry Points0
Unprotected0
WordPress Hooks 8
actioninitincludes\I18n.php:18
actionadmin_menuincludes\Page\Settings.php:25
actionadmin_enqueue_scriptsincludes\Page\Settings.php:29
actionphpmailer_initincludes\PluginCore.php:28
filterwp_mail_fromincludes\PluginCore.php:29
filterwp_mail_from_nameincludes\PluginCore.php:30
filtercron_schedulesincludes\Schedule.php:21
actionplugins_loadedyay-smtp.php:88
Maintenance & Trust

SMTP for SendGrid – YaySMTP Maintenance & Trust

Maintenance Signals

WordPress version tested7.0.2
Last updatedMay 18, 2026
PHP min version5.3
Downloads17K

Community Trust

Rating100/100
Number of ratings2
Active installs1K
Alternatives

SMTP for SendGrid – YaySMTP Alternatives

GoSMTP – SMTP for WordPress

GoSMTP – SMTP for WordPress

gosmtp

A
100

Send emails from your WordPress site using your preferred SMTP provider like Gmail, Outlook, AWS, Zoho, SMTP.com, Brevo (formerly Sendinblue), Mailgun &hellip;

500K No CVEs
YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports

YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports

yaysmtp

A
93

Free WordPress SMTP plugin with email logs, open & click tracking, reports & charts, CSV export, and WooCommerce email preview.

10K 8 CVEs
Swift SMTP (formerly Welcome Email Editor)

Swift SMTP (formerly Welcome Email Editor)

welcome-email-editor

A
99

Swift SMTP is a free & simple SMTP Plugin for WordPress.

7K 2 CVEs
Bit SMTP – Easy SMTP Solution with Email Logs

Bit SMTP – Easy SMTP Solution with Email Logs

bit-smtp

A
99

SMTP plugin for reliable and secure email delivery. Connect with Gmail, Outlook, Sendgrid, Brevo, MailGun, Amazon SES, and more mail SMTP servers.

2K 1 CVE
WP SendGrid SMTP

WP SendGrid SMTP

wp-sendgrid-smtp

C
63

WP SendGrid SMTP plugin let you can connect SendGrid SMTP to your WordPress website for sending emails. It bypasses the normal WP mail function and se &hellip;

1K 1 unpatched
Developer Profile

SMTP for SendGrid – YaySMTP Developer Profile

YayCommerce

16 plugins · 78K total installs

78
trust score
Avg Security Score
98/100
Avg Patch Time
126 days
View full developer profile
Detection Fingerprints

How We Detect SMTP for SendGrid – YaySMTP

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/smtp-sendgrid/assets/css/yay-smtp-admin.css/wp-content/plugins/smtp-sendgrid/assets/js/yay-smtp-admin.js/wp-content/plugins/smtp-sendgrid/assets/js/purify.min.js
Script Paths
/wp-content/plugins/smtp-sendgrid/assets/js/yay-smtp-admin.js/wp-content/plugins/smtp-sendgrid/assets/js/purify.min.js
Version Parameters
smtp-sendgrid/assets/css/yay-smtp-admin.css?ver=smtp-sendgrid/assets/js/yay-smtp-admin.js?ver=smtp-sendgrid/assets/js/purify.min.js?ver=

HTML / DOM Fingerprints

Data Attributes
data-pageid="yaysmtp-sendgrid-settings"
JS Globals
window.yay_smtp_sendgrid_wp_data
FAQ

Frequently Asked Questions about SMTP for SendGrid – YaySMTP