Yaycommerce
29 CVEs across 13 Yaycommerce products. Browse Yaycommerce vulnerabilities, severities, and proof-of-concept exploits.
Yaycommerce products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-66442 | Medium | 5.4 | 2026-07-27 | Subscriber Broken Access Control in YayPricing <= 3.5.6 versions. |
CVE-2026-39496 | High | 7.6 | 2026-04-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YayMail yaymail allows Blind SQL Injection.Th… |
CVE-2025-67994 | High | 7.5 | 2026-02-20 | Missing Authorization vulnerability in YayCommerce YayCurrency yaycurrency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2026-27327 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in YayCommerce YayMail yaymail allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Y… |
CVE-2026-1943 | Medium | 4.4 | 2026-02-18 | The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including… |
CVE-2026-1938 | Medium | 5.3 | 2026-02-18 | The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized license key deletion due to a missing authorization check on the… |
CVE-2026-1831 | Low | 2.7 | 2026-02-18 | The YayMail - WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized plugin installation and activation due to missing capability chec… |
CVE-2026-1937 | High | 7.2 | 2026-02-18 | The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to… |
CVE-2025-60077 | High | 7.5 | 2025-12-18 | Missing Authorization vulnerability in YayCommerce YayPricing yaypricing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Yay… |
CVE-2025-60114 | Medium | 6.6 | 2025-09-26 | Improper Control of Generation of Code ('Code Injection') vulnerability in YayCommerce YayCurrency yaycurrency allows Code Injection.This issue affects YayCurr… |
CVE-2025-54043 | High | 7.6 | 2025-07-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce SMTP for Amazon SES smtp-amazon-ses allows SQ… |
CVE-2025-48301 | High | 7.6 | 2025-07-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce SMTP for SendGrid – YaySMTP smtp-sendgrid all… |
CVE-2025-48299 | High | 7.6 | 2025-07-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YayExtra yayextra allows SQL Injection.This i… |
CVE-2025-48161 | High | 7.6 | 2025-07-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YaySMTP smtp-sendinblue allows SQL Injection… |
CVE-2025-53256 | High | 7.6 | 2025-06-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YaySMTP yaysmtp allows SQL Injection.This iss… |
CVE-2025-47587 | High | 7.6 | 2025-05-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YaySMTP yaysmtp allows Blind SQL Injection.Th… |
CVE-2025-3434 | High | 7.2 | 2025-04-11 | The SMTP for Amazon SES – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Logs in all versions up to, and including, 1.8 du… |
CVE-2025-31415 | High | 7.6 | 2025-04-01 | Missing Authorization vulnerability in YayCommerce YayExtra yayextra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-0957 | High | 7.2 | 2025-02-22 | The SMTP for Amazon SES – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.7.1 due to insufficient… |
CVE-2025-0953 | High | 7.2 | 2025-02-22 | The SMTP for Sendinblue – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2 due to insufficient i… |
CVE-2025-0918 | High | 7.2 | 2025-02-22 | The SMTP for SendGrid – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4 due to insufficient inp… |
CVE-2025-0916 | High | 7.2 | 2025-02-19 | The YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service plugin for WordPress is vulnerable to Stored Cross-Site… |
CVE-2024-54348 | Medium | 6.5 | 2024-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yaycommerce Brand brand allows Stored XSS.This issue affe… |
CVE-2024-7257 | Critical | 9.8 | 2024-08-03 | The YayExtra – WooCommerce Extra Product Options plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle… |
CVE-2023-3093 | High | 7.2 | 2023-07-12 | The YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.4.5 due to insufficient in… |
CVE-2022-2372 | Medium | 4.8 | 2022-08-08 | The YaySMTP WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform St… |
CVE-2022-2371 | Medium | 5.4 | 2022-08-08 | The YaySMTP WordPress plugin before 2.2.1 does not have proper authorisation when saving its settings, allowing users with a role as low as subscriber to chang… |
CVE-2022-2370 | Medium | 6.5 | 2022-08-01 | The YaySMTP WordPress plugin before 2.2.1 does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any aut… |
CVE-2022-2369 | Medium | 4.3 | 2022-08-01 | The YaySMTP WordPress plugin before 2.2.1 does not have capability check in an AJAX action, allowing any logged in users, such as subscriber to view the Logs o… |