# cve.now: Yaycommerce

The newest entries naming Yaycommerce as an affected vendor (up to 200), of 28 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-109977](https://cve.now/CVE-2026-109977.md): YaySMTP \<= 2.7.8 - Authenticated (Administrator+) SQL Injection via 'params\[searchKey\]' Parameter (CVSS 4.9)
- [CVE-2026-42701](https://cve.now/CVE-2026-42701.md): WordPress YayMail plugin \<= 4.4.6 - PHP Object Injection vulnerability (CVSS 7.2)
- [CVE-2026-92553](https://cve.now/CVE-2026-92553.md): YaySMTP \<= 2.7.7 - Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extension (CVSS 8.8)
- [CVE-2026-66442](https://cve.now/CVE-2026-66442.md): WordPress YayPricing plugin \<= 3.5.6 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2026-39496](https://cve.now/CVE-2026-39496.md): WordPress YayMail plugin \<= 4.3.3 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2025-67994](https://cve.now/CVE-2025-67994.md): WordPress YayCurrency plugin \<= 3.3 - Arbitrary Content Deletion vulnerability (CVSS 7.5)
- [CVE-2026-27327](https://cve.now/CVE-2026-27327.md): WordPress YayMail – WooCommerce Email Customizer plugin \<= 4.3.2 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-1831](https://cve.now/CVE-2026-1831.md): YayMail \<= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activation (CVSS 2.7)
- [CVE-2026-1943](https://cve.now/CVE-2026-1943.md): YayMail \<= 4.3.2 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elements (CVSS 4.4)
- [CVE-2026-1938](https://cve.now/CVE-2026-1938.md): YayMail \<= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via '/yaymail-license/v1/license/delete' Endpoint (CVSS 5.3)
- [CVE-2026-1937](https://cve.now/CVE-2026-1937.md): YayMail \<= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail\_import\_state' AJAX Action (CVSS 7.2)
- [CVE-2025-60077](https://cve.now/CVE-2025-60077.md): WordPress YayPricing plugin \<= 3.5.3 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2025-60114](https://cve.now/CVE-2025-60114.md): WordPress YayCurrency plugin \<= 3.3.1 - Remote Code Execution (RCE) vulnerability (CVSS 6.6)
- [CVE-2025-48161](https://cve.now/CVE-2025-48161.md): WordPress YaySMTP plugin \<= 1.3 - SQL Injection Vulnerability (CVSS 7.6)
- [CVE-2025-48299](https://cve.now/CVE-2025-48299.md): WordPress YayExtra plugin \<= 1.5.5 - SQL Injection Vulnerability (CVSS 7.6)
- [CVE-2025-48301](https://cve.now/CVE-2025-48301.md): WordPress SMTP for SendGrid – YaySMTP plugin \<= 1.5 - SQL Injection Vulnerability (CVSS 7.6)
- [CVE-2025-54043](https://cve.now/CVE-2025-54043.md): WordPress SMTP for Amazon SES plugin \<= 1.9 - SQL Injection Vulnerability (CVSS 7.6)
- [CVE-2025-53256](https://cve.now/CVE-2025-53256.md): WordPress YaySMTP plugin \<= 2.6.6 - SQL Injection Vulnerability (CVSS 7.6)
- [CVE-2025-47587](https://cve.now/CVE-2025-47587.md): WordPress YaySMTP plugin \<= 2.6.4 - SQL Injection Vulnerability (CVSS 7.6)
- [CVE-2025-3434](https://cve.now/CVE-2025-3434.md): SMTP for Amazon SES – YaySMTP \<= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logs (CVSS 7.2)
- [CVE-2025-31415](https://cve.now/CVE-2025-31415.md): WordPress YayExtra \<= 1.5.2 - Broken Access Control Vulnerability (CVSS 7.6)
- [CVE-2025-0957](https://cve.now/CVE-2025-0957.md): Vulnerability: SMTP for Amazon SES \<= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logs (CVSS 7.2)
- [CVE-2025-0953](https://cve.now/CVE-2025-0953.md): SMTP for Sendinblue – YaySMTP \<= 1.2 - Unauthenticated Stored Cross-Site Scripting via Email Logs (CVSS 7.2)
- [CVE-2025-0918](https://cve.now/CVE-2025-0918.md): SMTP for SendGrid – YaySMTP \<= 1.4 - Unauthenticated Stored Cross-Site Scripting via Email Logs (CVSS 7.2)
- [CVE-2025-0916](https://cve.now/CVE-2025-0916.md): YaySMTP 2.4.9 - 2.6.2 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2024-54348](https://cve.now/CVE-2024-54348.md): WordPress Brandy theme \<= 1.1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-7257](https://cve.now/CVE-2024-7257.md): YayExtra – WooCommerce Extra Product Options \<= 1.3.7 - Unauthenticated Arbitrary File Upload via handle\_upload\_file Function (CVSS 9.8)
- [CVE-2023-3093](https://cve.now/CVE-2023-3093.md): YaySMTP \<= 2.4.5 - Unauthenticated Stored Cross-Site Scripting via Email (CVSS 7.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/yaycommerce
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.