YA
Vendor
YayCommerce
35
CVEs
0
On KEV
2
New 30D
Products
YA7.6
YayMail
YayCommerce
3 CVEs0 on KEV1 new
YW8.8
YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports
yaycommerce
1 CVEs0 on KEV1 new
YA7.6
YaySMTP
YayCommerce
11 CVEs0 on KEV0 new
YW7.2
YayMail – WooCommerce Email Customizer
yaycommerce
4 CVEs0 on KEV0 new
YA9.8
YayExtra
YayCommerce
3 CVEs0 on KEV0 new
SF7.2
SMTP for Amazon SES – YaySMTP
yaycommerce
2 CVEs0 on KEV0 new
SF7.6
SMTP for SendGrid – YaySMTP
yaycommerce
2 CVEs0 on KEV0 new
YA7.5
YayCurrency
YayCommerce
2 CVEs0 on KEV0 new
YA7.5
YayPricing
YayCommerce
2 CVEs0 on KEV0 new
BR6.5
Brand
yaycommerce
1 CVEs0 on KEV0 new
SF7.6
SMTP for Amazon SES
YayCommerce
1 CVEs0 on KEV0 new
SF6.1
SMTP for Sendinblue – YaySMTP
yaycommerce
1 CVEs0 on KEV0 new
YW9.8
YayExtra – WooCommerce Extra Product Options
yaycommerce
1 CVEs0 on KEV0 new
YA6.1
YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service
yaycommerce
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-42701 New | YA YayMail YayCommerce | 7.2 | Oct 29 | WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability |
| CVE-2026-92553 | YW YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports yaycommerce | 8.8 | Oct 16 | YaySMTP <= 2.7.7 - Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extension |
| CVE-2026-66442 | YA YayPricing YayCommerce | 5.4 | Jul 27 | WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability |
| CVE-2026-39496 | YA YayMail YayCommerce | 7.6 | Apr 8 | WordPress YayMail plugin <= 4.3.3 - SQL Injection vulnerability |
| CVE-2025-67994 | YA YayCurrency YayCommerce | 7.5 | Feb 20 | WordPress YayCurrency plugin <= 3.3 - Arbitrary Content Deletion vulnerability |
| CVE-2026-27327 | YA YayMail YayCommerce | 4.3 | Feb 19 | WordPress YayMail – WooCommerce Email Customizer plugin <= 4.3.2 - Broken Access Control vulnerability |
| CVE-2026-1831 | YW YayMail – WooCommerce Email Customizer yaycommerce | 2.7 | Feb 18 | YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activation |
| CVE-2026-1943 | YW YayMail – WooCommerce Email Customizer yaycommerce | 4.4 | Feb 18 | YayMail <= 4.3.2 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elements |
| CVE-2026-1938 | YW YayMail – WooCommerce Email Customizer yaycommerce | 5.3 | Feb 18 | YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via '/yaymail-license/v1/license/delete' Endpoint |
| CVE-2026-1937 | YW YayMail – WooCommerce Email Customizer yaycommerce | 7.2 | Feb 18 | YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail_import_state' AJAX Action |
| CVE-2025-60077 | YA YayPricing YayCommerce | 7.5 | Dec 18 | WordPress YayPricing plugin <= 3.5.3 - Broken Access Control vulnerability |
| CVE-2025-60114 | YA YayCurrency YayCommerce | 6.6 | Sep 26 | WordPress YayCurrency plugin <= 3.3.1 - Remote Code Execution (RCE) vulnerability |
| CVE-2025-48161 | YA YaySMTP YayCommerce | 7.6 | Jul 16 | WordPress YaySMTP plugin <= 1.3 - SQL Injection Vulnerability |
| CVE-2025-48299 | YA YayExtra YayCommerce | 7.6 | Jul 16 | WordPress YayExtra plugin <= 1.5.5 - SQL Injection Vulnerability |
| CVE-2025-48301 | SF SMTP for SendGrid – YaySMTP YayCommerce | 7.6 | Jul 16 | WordPress SMTP for SendGrid – YaySMTP plugin <= 1.5 - SQL Injection Vulnerability |
| CVE-2025-54043 | SF SMTP for Amazon SES YayCommerce | 7.6 | Jul 16 | WordPress SMTP for Amazon SES plugin <= 1.9 - SQL Injection Vulnerability |
| CVE-2025-53256 | YA YaySMTP YayCommerce | 7.6 | Jun 27 | WordPress YaySMTP plugin <= 2.6.6 - SQL Injection Vulnerability |
| CVE-2025-47587 | YA YaySMTP YayCommerce | 7.6 | May 7 | WordPress YaySMTP plugin <= 2.6.4 - SQL Injection Vulnerability |
| CVE-2025-3434 | SF SMTP for Amazon SES – YaySMTP yaycommerce | 7.2 | Apr 11 | SMTP for Amazon SES – YaySMTP <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logs |
| CVE-2025-31415 | YA YayExtra YayCommerce | 7.6 | Apr 1 | WordPress YayExtra <= 1.5.2 - Broken Access Control Vulnerability |
| CVE-2025-0957 | SF SMTP for Amazon SES – YaySMTP yaycommerce | 7.2 | Feb 22 | Vulnerability: SMTP for Amazon SES <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logs |
| CVE-2025-0953 | SF SMTP for Sendinblue – YaySMTP yaycommerce | 6.1 | Feb 22 | SMTP for Sendinblue – YaySMTP <= 1.2 - Unauthenticated Stored Cross-Site Scripting via Email Logs |
| CVE-2025-0918 | SF SMTP for SendGrid – YaySMTP yaycommerce | 6.1 | Feb 22 | SMTP for SendGrid – YaySMTP <= 1.4 - Unauthenticated Stored Cross-Site Scripting via Email Logs |
| CVE-2025-0916 | YA YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service yaycommerce | 6.1 | Feb 19 | YaySMTP 2.4.9 - 2.6.2 - Unauthenticated Stored Cross-Site Scripting |
| CVE-2024-54348 | BR Brand yaycommerce | 6.5 | Dec 16 | WordPress Brandy theme <= 1.1.6 - Cross Site Scripting (XSS) vulnerability |
| CVE-2024-7257 | YW YayExtra – WooCommerce Extra Product Options yaycommerce | 9.8 | Aug 3 | YayExtra – WooCommerce Extra Product Options <= 1.3.7 - Unauthenticated Arbitrary File Upload via handle_upload_file Function |
| CVE-2023-3093 | YA Yaysmtp Yaycommerce | 6.1 | Jul 12 | The YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.4.5 due to insufficient input sanitization and… |
| CVE-2022-2372 | YA Yaysmtp Yaycommerce | 4.8 | Aug 8 | YaySMTP < 2.2.2 - Admin+ Stored Cross-Site Scripting |
| CVE-2022-2371 | YA Yaysmtp Yaycommerce | 5.4 | Aug 8 | YaySMTP < 2.2.1 - Subscriber+ Stored Cross-Site Scripting |
| CVE-2022-2370 | YA Yaysmtp Yaycommerce | 6.5 | Aug 1 | YaySMTP < 2.2.1 - Subscriber+ SMTP Credentials Leak |
| CVE-2022-2369 | YA Yaysmtp Yaycommerce | 4.3 | Aug 1 | YaySMTP < 2.2.1 - Subscriber+ Logs Disclosure |