Skip to content
Yaycommerce vulnerabilities
Newest
-
yaycommerce yaysmtp – wp mail smtp with email logs, tracking & reports
YaySMTP <= 2.7.8 - Authenticated (Administrator+) SQL Injection via 'params[searchKey]' Parameter
CVE-2026-109977
4.9 Medium
-
yaycommerce yaymail
WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability
CVE-2026-42701
7.2 High
-
yaycommerce yaysmtp – wp mail smtp with email logs, tracking & reports
YaySMTP <= 2.7.7 - Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extension
CVE-2026-92553
8.8 High
-
unknown yaypricing
YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route
CVE-2026-87888
8.0 High
-
unknown yaycurrency
YayCurrency < 3.3.5 - Unauthenticated Order and Vendor Financial Data Disclosure via Dokan Integration
CVE-2026-16058
5.3 Medium
-
unknown yaypricing
YayPricing < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclosure
CVE-2026-15230
8.1 High
-
yaycommerce yaypricing
WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability
CVE-2026-66442
5.4 Medium
-
yaycommerce yaymail
WordPress YayMail plugin <= 4.3.3 - PHP Object Injection vulnerability
CVE-2026-39498
7.2 High
-
yaycommerce yaymail
WordPress YayMail plugin <= 4.3.3 - SQL Injection vulnerability
CVE-2026-39496
7.6 High
-
yaycommerce yaycurrency
WordPress YayCurrency plugin <= 3.3 - Arbitrary Content Deletion vulnerability
CVE-2025-67994
7.5 High
-
yaycommerce yaymail
WordPress YayMail – WooCommerce Email Customizer plugin <= 4.3.2 - Broken Access Control vulnerability
CVE-2026-27327
4.3 Medium
-
yaycommerce yaymail – woocommerce email customizer
YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activation
CVE-2026-1831
2.7 Low
-
yaycommerce yaymail – woocommerce email customizer
YayMail <= 4.3.2 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elements
CVE-2026-1943
4.4 Medium
-
yaycommerce yaymail – woocommerce email customizer
YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via '/yaymail-license/v1/license/delete' Endpoint
CVE-2026-1938
5.3 Medium
-
yaycommerce yaymail – woocommerce email customizer
YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail_import_state' AJAX Action
CVE-2026-1937
Public exploit
7.2 High
-
yaycommerce yaypricing
WordPress YayPricing plugin <= 3.5.3 - Broken Access Control vulnerability
CVE-2025-60077
7.5 High
-
yaycommerce yaycurrency
WordPress YayCurrency plugin <= 3.3.1 - Remote Code Execution (RCE) vulnerability
CVE-2025-60114
6.6 Medium
-
yaycommerce yaysmtp
WordPress YaySMTP plugin <= 1.3 - SQL Injection Vulnerability
CVE-2025-48161
7.6 High
-
yaycommerce smtp for sendgrid – yaysmtp
WordPress SMTP for SendGrid – YaySMTP plugin <= 1.5 - SQL Injection Vulnerability
CVE-2025-48301
7.6 High
-
yaycommerce yayextra
WordPress YayExtra plugin <= 1.5.5 - SQL Injection Vulnerability
CVE-2025-48299
7.6 High
-
yaycommerce smtp for amazon ses
WordPress SMTP for Amazon SES plugin <= 1.9 - SQL Injection Vulnerability
CVE-2025-54043
7.6 High
-
yaycommerce yaysmtp
WordPress YaySMTP plugin <= 2.6.6 - SQL Injection Vulnerability
CVE-2025-53256
7.6 High
-
yaycommerce yaysmtp
WordPress YaySMTP plugin <= 2.6.4 - SQL Injection Vulnerability
CVE-2025-47587
7.6 High
-
yaycommerce smtp for amazon ses – yaysmtp
SMTP for Amazon SES – YaySMTP <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logs
CVE-2025-3434
7.2 High
-
yaycommerce yayextra
WordPress YayExtra <= 1.5.2 - Broken Access Control Vulnerability
CVE-2025-31415
7.6 High
-
yaycommerce smtp for amazon ses – yaysmtp
Vulnerability: SMTP for Amazon SES <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logs
CVE-2025-0957
7.2 High
-
yaycommerce smtp for sendinblue – yaysmtp, yaysmtp +1 more
SMTP for Sendinblue – YaySMTP <= 1.2 - Unauthenticated Stored Cross-Site Scripting via Email Logs
CVE-2025-0953
7.2 High
-
yaycommerce smtp for sendgrid – yaysmtp, yaysmtp +1 more
SMTP for SendGrid – YaySMTP <= 1.4 - Unauthenticated Stored Cross-Site Scripting via Email Logs
CVE-2025-0918
7.2 High
-
yaycommerce yaysmtp, yaysmtp and email logs: amazon ses, sendgrid, outlook, mailgun, brevo, google and any smtp service +1 more
YaySMTP 2.4.9 - 2.6.2 - Unauthenticated Stored Cross-Site Scripting
CVE-2025-0916
7.2 High
-
yaycommerce brand
WordPress Brandy theme <= 1.1.6 - Cross Site Scripting (XSS) vulnerability
CVE-2024-54348
6.5 Medium
-
5starplugins easy age verify, featured images in rss for mailchimp & more, marijuana age verify +619 more +621 more
Freemius SDK <= 2.4.2 - Missing Authorization Checks
CVE-2022-4974
6.3 Medium
-
yaycommerce yayextra, yayextra – woocommerce extra product options +1 more
YayExtra – WooCommerce Extra Product Options <= 1.3.7 - Unauthenticated Arbitrary File Upload via handle_upload_file Function
CVE-2024-7257
9.8 Critical
-
yaycommerce yaysmtp, yaysmtp and email logs: amazon ses, sendgrid, outlook, mailgun, brevo, google and any smtp service +1 more
YaySMTP <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting via Email
CVE-2023-3093
7.2 High
-
yaycommerce yaysmtp, unknown yaysmtp – simple wp smtp mail +1 more
YaySMTP < 2.2.2 - Admin+ Stored Cross-Site Scripting
CVE-2022-2372
4.8 Medium
-
yaycommerce yaysmtp, unknown yaysmtp – simple wp smtp mail +1 more
YaySMTP < 2.2.1 - Subscriber+ Stored Cross-Site Scripting
CVE-2022-2371
5.4 Medium
-
unknown yaysmtp
YaySMTP < 2.2.1 - Subscriber+ SMTP Credentials Leak
CVE-2022-2370
6.5 Medium
-
yaycommerce yaysmtp, unknown yaysmtp – simple wp smtp mail +1 more
YaySMTP < 2.2.1 - Subscriber+ Logs Disclosure
CVE-2022-2369
4.3 Medium