Skip to content
OpenAdvisories

Vendor

YayCommerce

28 known vulnerabilities.

Products

YayMail – WooCommerce Email Customizer 4 YayMail 3 YaySMTP 3 YayCurrency 2 SMTP for Amazon SES – YaySMTP 2 YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports 2 YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service 2 YayExtra 2 SMTP for SendGrid – YaySMTP 2 YayPricing 2 Brand 1 SMTP for Amazon SES 1 SMTP for Sendinblue – YaySMTP 1 YayExtra – WooCommerce Extra Product Options 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 4.9
    CVE-2026-109977

    YaySMTP <= 2.7.8 - Authenticated (Administrator+) SQL Injection via 'params[searchKey]' Parameter

    The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to time-based SQL Injection via the 'params[searchKey]' parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied p…

    YayCommerce YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports Web / CMS
  • Medium 5.4
    CVE-2026-66442

    WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability

    Subscriber Broken Access Control in YayPricing <= 3.5.6 versions.

    YayCommerce YayPricing
  • Medium 4.3
    CVE-2026-27327

    WordPress YayMail – WooCommerce Email Customizer plugin <= 4.3.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in YayCommerce YayMail yaymail allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YayMail: from n/a through <= 4.3.2.

    YayCommerce YayMail
  • Medium 5.3
    CVE-2026-1938

    YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via '/yaymail-license/v1/license/delete' Endpoint

    The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized license key deletion due to a missing authorization check on the `/yaymail-license/v1/license/delete` REST endpoint in versions up to, and including, 4.3.2. This mak…

    YayCommerce YayMail – WooCommerce Email Customizer Web / CMS
  • Medium 4.4
    CVE-2026-1943

    YayMail <= 4.3.2 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elements

    The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 4.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authen…

    YayCommerce YayMail – WooCommerce Email Customizer Web / CMS
  • Medium 6.6
    CVE-2025-60114

    WordPress YayCurrency plugin <= 3.3.1 - Remote Code Execution (RCE) vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in YayCommerce YayCurrency yaycurrency allows Code Injection.This issue affects YayCurrency: from n/a through <= 3.3.1.

    YayCommerce YayCurrency
  • Medium 6.5
    CVE-2024-54348

    WordPress Brandy theme <= 1.1.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yaycommerce Brand brand allows Stored XSS.This issue affects Brand: from n/a through <= 1.1.6.

    YayCommerce Brand