yaycommerce vulnerabilities
28 published CVEs name yaycommerce among the affected products.
- 28Published CVEs28 of them scored
- 12Last 12 monthspublished in the last year
- 1Critical19 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-109977
YaySMTP <= 2.7.8 - Authenticated (Administrator+) SQL Injection via 'params[searchKey]' Parameter
yaycommerce · YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports
Medium4.9 - CVE-2026-42701
WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability
YayCommerce · YayMail
High7.2 - CVE-2026-92553
YaySMTP <= 2.7.7 - Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extension
yaycommerce · YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports
High8.8 - CVE-2026-66442
WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability
YayCommerce · YayPricing
Medium5.4 - CVE-2026-39496
WordPress YayMail plugin <= 4.3.3 - SQL Injection vulnerability
YayCommerce · YayMail
High7.6 - CVE-2025-67994
WordPress YayCurrency plugin <= 3.3 - Arbitrary Content Deletion vulnerability
YayCommerce · YayCurrency
High7.5 - CVE-2026-27327
WordPress YayMail – WooCommerce Email Customizer plugin <= 4.3.2 - Broken Access Control vulnerability
YayCommerce · YayMail
Medium4.3 - CVE-2026-1831
YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activation
yaycommerce · YayMail – WooCommerce Email Customizer
Low2.7 - CVE-2026-1943
YayMail <= 4.3.2 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elements
yaycommerce · YayMail – WooCommerce Email Customizer
Medium4.4 - CVE-2026-1938
YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via '/yaymail-license/v1/license/delete' Endpoint
yaycommerce · YayMail – WooCommerce Email Customizer
Medium5.3