Log in Start free

YayCommerce

Products

ProductCVEsExploitedLatest
YayMail – WooCommerce Email Customizer4–Feb 18, 2026
YaySMTP3–Jul 16, 2025
YayMail3–Oct 29, 2026
SMTP for Amazon SES – YaySMTP2–Apr 11, 2025
YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service2–Feb 19, 2025
YayCurrency2–Feb 20, 2026
YayExtra2–Jul 16, 2025
SMTP for SendGrid – YaySMTP2–Jul 16, 2025
YayPricing2–Jul 27, 2026
YayExtra – WooCommerce Extra Product Options1–Aug 3, 2024
SMTP for Amazon SES1–Jul 16, 2025
SMTP for Sendinblue – YaySMTP1–Feb 22, 2025
Brand1–Dec 16, 2024
YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports1–Oct 16, 2026

Exploited and recent CVEs

  • CVE-2026-42701 High 7.2 WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability 0.4%
  • CVE-2026-92553 High 8.8 YaySMTP <= 2.7.7 - Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extension 0.6%
  • CVE-2026-66442 Medium 5.4 WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability 0.3%
  • CVE-2026-39496 High 7.6 WordPress YayMail plugin <= 4.3.3 - SQL Injection vulnerability 0.3%
  • CVE-2025-67994 High 7.5 WordPress YayCurrency plugin <= 3.3 - Arbitrary Content Deletion vulnerability 0.4%
  • CVE-2026-27327 Medium 4.3 WordPress YayMail – WooCommerce Email Customizer plugin <= 4.3.2 - Broken Access Control vulnerability 0.2%
  • CVE-2026-1831 Low 2.7 YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activation 0.3%
  • CVE-2026-1943 Medium 4.4 YayMail <= 4.3.2 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elements 0.3%
  • CVE-2026-1938 Medium 5.3 YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via '/yaymail-license/v1/license/delete' Endpoint 0.3%
  • CVE-2026-1937 High 7.2 YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail_import_state' AJAX Action 0.5%
  • CVE-2025-60077 High 7.5 WordPress YayPricing plugin <= 3.5.3 - Broken Access Control vulnerability 0.3%
  • CVE-2025-60114 Medium 6.6 WordPress YayCurrency plugin <= 3.3.1 - Remote Code Execution (RCE) vulnerability 0.3%
  • CVE-2025-48161 High 7.6 WordPress YaySMTP plugin <= 1.3 - SQL Injection Vulnerability 0.4%
  • CVE-2025-48299 High 7.6 WordPress YayExtra plugin <= 1.5.5 - SQL Injection Vulnerability 0.4%
  • CVE-2025-48301 High 7.6 WordPress SMTP for SendGrid – YaySMTP plugin <= 1.5 - SQL Injection Vulnerability 0.4%
  • CVE-2025-54043 High 7.6 WordPress SMTP for Amazon SES plugin <= 1.9 - SQL Injection Vulnerability 0.3%
  • CVE-2025-53256 High 7.6 WordPress YaySMTP plugin <= 2.6.6 - SQL Injection Vulnerability 0.4%
  • CVE-2025-47587 High 7.6 WordPress YaySMTP plugin <= 2.6.4 - SQL Injection Vulnerability 0.4%
  • CVE-2025-3434 High 7.2 SMTP for Amazon SES – YaySMTP <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logs 0.5%
  • CVE-2025-31415 High 7.6 WordPress YayExtra <= 1.5.2 - Broken Access Control Vulnerability 0.4%
  • CVE-2025-0957 High 7.2 Vulnerability: SMTP for Amazon SES <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logs 0.5%
  • CVE-2025-0953 High 7.2 SMTP for Sendinblue – YaySMTP <= 1.2 - Unauthenticated Stored Cross-Site Scripting via Email Logs 0.4%
  • CVE-2025-0918 High 7.2 SMTP for SendGrid – YaySMTP <= 1.4 - Unauthenticated Stored Cross-Site Scripting via Email Logs 0.4%
  • CVE-2025-0916 High 7.2 YaySMTP 2.4.9 - 2.6.2 - Unauthenticated Stored Cross-Site Scripting 0.4%
  • CVE-2024-54348 Medium 6.5 WordPress Brandy theme <= 1.1.6 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2024-7257 Critical 9.8 YayExtra – WooCommerce Extra Product Options <= 1.3.7 - Unauthenticated Arbitrary File Upload via handle_upload_file Function 1.0%
  • CVE-2023-3093 High 7.2 YaySMTP <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting via Email 0.5%