yaycommerce vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20242
3. 202514
4. 202611

Newest CVEs

• CVE-2026-109977

  YaySMTP <= 2.7.8 - Authenticated (Administrator+) SQL Injection via 'params[searchKey]' Parameter

  yaycommerce · YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports

  Medium4.9
• CVE-2026-42701

  WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability

  YayCommerce · YayMail

  High7.2
• CVE-2026-92553

  YaySMTP <= 2.7.7 - Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extension

  yaycommerce · YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports

  High8.8
• CVE-2026-66442

  WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability

  YayCommerce · YayPricing

  Medium5.4
• CVE-2026-39496

  WordPress YayMail plugin <= 4.3.3 - SQL Injection vulnerability

  YayCommerce · YayMail

  High7.6
• CVE-2025-67994

  WordPress YayCurrency plugin <= 3.3 - Arbitrary Content Deletion vulnerability

  YayCommerce · YayCurrency

  High7.5
• CVE-2026-27327

  WordPress YayMail – WooCommerce Email Customizer plugin <= 4.3.2 - Broken Access Control vulnerability

  YayCommerce · YayMail

  Medium4.3
• CVE-2026-1831

  YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activation

  yaycommerce · YayMail – WooCommerce Email Customizer

  Low2.7
• CVE-2026-1943

  YayMail <= 4.3.2 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elements

  yaycommerce · YayMail – WooCommerce Email Customizer

  Medium4.4
• CVE-2026-1938

  YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via '/yaymail-license/v1/license/delete' Endpoint

  yaycommerce · YayMail – WooCommerce Email Customizer

  Medium5.3