Yaycommerce vulnerabilities
28 CVEs and advisories name Yaycommerce as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-109977YaySMTP <= 2.7.8 - Authenticated (Administrator+) SQL Injection via 'params[searchKey]' Parameter
- CVE-2026-42701WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability
- CVE-2026-92553YaySMTP <= 2.7.7 - Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extension
- CVE-2026-66442WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability
- CVE-2026-39496WordPress YayMail plugin <= 4.3.3 - SQL Injection vulnerability
- CVE-2025-67994WordPress YayCurrency plugin <= 3.3 - Arbitrary Content Deletion vulnerability
- CVE-2026-27327WordPress YayMail – WooCommerce Email Customizer plugin <= 4.3.2 - Broken Access Control vulnerability
- CVE-2026-1831YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activation
- CVE-2026-1943YayMail <= 4.3.2 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elements
- CVE-2026-1938YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via '/yaymail-license/v1/license/delete' Endpoint
- CVE-2026-1937YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail_import_state' AJAX Action
- CVE-2025-60077WordPress YayPricing plugin <= 3.5.3 - Broken Access Control vulnerability
- CVE-2025-60114WordPress YayCurrency plugin <= 3.3.1 - Remote Code Execution (RCE) vulnerability
- CVE-2025-48161WordPress YaySMTP plugin <= 1.3 - SQL Injection Vulnerability
- CVE-2025-48299WordPress YayExtra plugin <= 1.5.5 - SQL Injection Vulnerability
- CVE-2025-48301WordPress SMTP for SendGrid – YaySMTP plugin <= 1.5 - SQL Injection Vulnerability
- CVE-2025-54043WordPress SMTP for Amazon SES plugin <= 1.9 - SQL Injection Vulnerability
- CVE-2025-53256WordPress YaySMTP plugin <= 2.6.6 - SQL Injection Vulnerability
- CVE-2025-47587WordPress YaySMTP plugin <= 2.6.4 - SQL Injection Vulnerability
- CVE-2025-3434SMTP for Amazon SES – YaySMTP <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logs
- CVE-2025-31415WordPress YayExtra <= 1.5.2 - Broken Access Control Vulnerability
- CVE-2025-0957Vulnerability: SMTP for Amazon SES <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logs
- CVE-2025-0953SMTP for Sendinblue – YaySMTP <= 1.2 - Unauthenticated Stored Cross-Site Scripting via Email Logs
- CVE-2025-0918SMTP for SendGrid – YaySMTP <= 1.4 - Unauthenticated Stored Cross-Site Scripting via Email Logs
- CVE-2025-0916YaySMTP 2.4.9 - 2.6.2 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-54348WordPress Brandy theme <= 1.1.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-7257YayExtra – WooCommerce Extra Product Options <= 1.3.7 - Unauthenticated Arbitrary File Upload via handle_upload_file Function
- CVE-2023-3093YaySMTP <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting via Email